ArkProject: NFT Bridge

Summary

No checks on token_id uniqueness.

Vulnerability Details

The function processes a list of token IDs without verifying whether each token_id is unique within the request. Here's the relevant part of the code:

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L146C8-L174C11

The problem here is that the same token_id could appear multiple times in req.ids, and the function would process it each time without any checks.

Suppose the request contains token IDs [1, 2, 1], and all these tokens are initially escrowed by the bridge contract.

• The first occurrence of token 1 is processed: It's successfully transferred to the recipient.

• Token 2 is processed: It's successfully transferred.

• The second occurrence of token 1 is processed: The transfer attempt will fail because the bridge no longer owns this token.

Impact

The function will attempt to transfer the same token again. This will fail because the bridge contract no longer owns the token after the first transfer.

Tools Used

Manual review

Recommendations

Implement checks for token ID uniqueness within each request.