Summary

If the number of whitelisted collections on L2 increases significantly, it leads to a situation that deploying new or changing the whitelist status by admin would be impossible.

Vulnerability Details

If the number of L2 collections deployed on L2 increases significantly, whitelisting the collections whether during withdrawal or when admin is changing the whitelist status would be impossible due to unbound gas consumption of the loop.

Because in the function _white_list_collection, the loop iterates over all the elements of whitelisted linked list to add/remove an element. If the length of this linked list is a lot, the gas consumption may become larger than block gas limit on Starknet.
https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/starknet/src/bridge.cairo#L491

Impact

• DoS due to unbounded loop.

Tools Used

Recommendations

The function _white_list_collection should be modified such that it could be iterated in parts by defining the starting/ending elements.