Function withdraw_auto_from_l1
on bridge.cairo
contract does not properly make sure the transaction initiator (caller) IS the Starklane
from L1.
User provides the from_address
argument instead of checking for the transaction caller on-chain like you would do with msg.sender
in Solidity.
Handler can send Starklane
L1 address to pass this check and then withdraw the NFT in question by constructing his own req
object.
Manual review
Rewrite the check as follows:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.