ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Function withdraw_auto_from_l1 on bridge.cairo does not ensure correct caller properly

matejdb

Summary

Function withdraw_auto_from_l1 on bridge.cairo contract does not properly make sure the transaction initiator (caller) IS the Starklane from L1.

Vulnerability Details

User provides the from_address argument instead of checking for the transaction caller on-chain like you would do with msg.sender in Solidity.

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L131C1-L131C31

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L135C1-L136C41

Impact

Handler can send Starklane L1 address to pass this check and then withdraw the NFT in question by constructing his own req object.

Tools Used

Manual review

Recommendations

Rewrite the check as follows:

assert(self.bridge_l1_address.read().into() == starknet::get_caller_address(),
'Invalid L1 msg sender');
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!