ArkProject: NFT Bridge

Summary

Incorrect whitelisting logic in _is_white_listed function causes unauthorized asset bridging.

Vulnerability Details

The _is_white_listed function contains a logic error that bypasses the whitelist check when the whitelist feature is disabled.

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L482C2-L489C6

The issue is that the logic above allows all collections to be considered white-listed when white-listing is disabled. If enabled is true, the function correctly checks the white list. However, if enabled is false, the function always returns true, bypassing the white list entirely.

It means that when white-listing is disabled, the function considers all collections to be white-listed.

This has a direct impact on the deposit_tokens function, which calls _is_white_listed to check if a collection is authorized for bridging.

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L261

Due to this bug, when the whitelist is disabled, any collection can be deposited for bridging, regardless of its actual whitelist status.

Also, the is_white_listed function will return true even if a collection is not white listed when enabled is false.

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L326

Impact

Users can deposit and bridge tokens from any collection.

is_white_listed will also return true for a on-whitelisted collection.

Tools Used

Manual review

Recommendations

Ensure that when white-listing is disabled, the function returns false for all collections.