ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Salt is used as argument instead of being random generated and nonce is not used as well

DPS

Summary

The salt in both L1 and L2 is being passed as argument which defeats its purpose. It should represent random generated data everytime so the hash is always diffrent and it makes sure that there will be no collisions. Also the nonce is not used as well which is an important part when creating a hash

Vulnerability Details

Here is the depositTokens() function from Bridge.sol (the same applies for the deposit_tokens() on L2)

​
function depositTokens(
uint256 salt,
address collectionL1,
snaddress ownerL2,
uint256[] calldata ids,
bool useAutoBurn
) external payable {
...
req.hash = Protocol.requestHash(salt, collectionL1, ownerL2, ids);
...

As we can see the hash is passed as argument instead of being randomly generated, also it is missing nonce which will assure the uniqueness of the hash

Impact

Low because there are other factors in the hash such as owner and ids which will make a collision's likelihood very low

Tools Used

Manual review

Recommendations

The easiest way to fix this is by adding nonce to the hash

Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.