ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Logical Bug in Message Consumption Process of StarklaneMessaging Contract

purpledragon

Summary

A logical bug was identified in the StarklaneMessaging Solidity contract, specifically within the _consumeMessageStarknet function. The bug allows a message to be consumed inadvertently before verifying its status, leading to potential inconsistencies and reversion of transactions. This report details the nature of the bug, its impact, and provides recommendations to resolve the issue.

Vulnerability Detail

The _consumeMessageStarknet function attempts to consume a message from the Starknet core contract using the consumeMessageFromL2 method. This method consumes the message and returns its hash. The function then checks if the message was intended for auto-withdraw by looking up the _autoWithdrawn mapping. If the message was meant for auto-withdraw, the function reverts with WithdrawMethodError.

However, the consumption of the message occurs before this verification, leading to a scenario where the message is consumed but the transaction is reverted, making the message non-reusable and causing inconsistencies.

Code Snippet

Original Code with Bug:

function _consumeMessageStarknet(
IStarknetMessaging starknetCore,
snaddress fromL2Address,
uint256[] memory request
)
internal
{
// Will revert if the message is not consumable.
bytes32 msgHash = starknetCore.consumeMessageFromL2(
snaddress.unwrap(fromL2Address),
request
);
​
// If the message were configured to be withdrawn with auto method,
// starknet method is denied.
if (_autoWithdrawn[msgHash] != WITHDRAW_AUTO_NONE) {
revert WithdrawMethodError();
}
}

Corrected Code:

function _consumeMessageStarknet(
IStarknetMessaging starknetCore,
snaddress fromL2Address,
uint256[] memory request
)
internal
{
bytes32 msgHash = keccak256(
abi.encodePacked(
snaddress.unwrap(fromL2Address),
request)
);
​
// If the message were configured to be withdrawn with auto method,
// starknet method is denied.
if (_autoWithdrawn[msgHash] != WITHDRAW_AUTO_NONE) {
revert WithdrawMethodError();
}
​
// Will revert if the message is not consumable.
starknetCore.consumeMessageFromL2(
snaddress.unwrap(fromL2Address),
request
);
}

Impact

The impact of this bug is significant as it can lead to message consumption before proper verification, causing unintended transaction reversion. This can result in:

  • Inconsistent state within the contract.

  • Loss of messages that cannot be reused.

  • Potential denial of service due to frequent reversion of transactions.

Recommendations

To resolve this issue, it is recommended to:

  1. Compute the msgHash and verify its status in the _autoWithdrawn mapping before consuming the message.

  2. Only proceed with the message consumption if it is valid for the Starknet method.

  3. Ensure thorough testing and verification of the contract logic to prevent similar issues in the future.

By implementing these changes, the contract will correctly handle message consumption, maintaining consistency and preventing unintended reversion of transactions.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.