ArkProject: NFT Bridge

Vulnerability Summary

The functions deployERC721Bridgeable() and deployERC1155Bridgeable() in the Depoloyer.sol library are currently marked as public. This increases gas costs due to the way DELEGATECALL is used to interact with these functions, leading to inefficiencies. Additionally, improper DELEGATECALL usage can cause unexpected behaviors in the contract.

Vulnerability Details

• Solidity libraries with external or public functions are deployed as separate, independent contracts on the blockchain.

• Contracts that utilize these libraries invoke their functions using DELEGATECALL.

• DELEGATECALL is more expensive in terms of gas compared to an internal function call.

• Libraries containing only internal functions are significantly more gas-efficient during runtime.

References :
https://eip2535diamonds.substack.com/p/the-difference-between-solidity-libraries

Impact

• Gas Optimization: Using internal functions instead of public or external functions reduces gas costs. Internal functions do not rely on DELEGATECALL and are directly invoked within the calling contract.

Recommendations

• Mark both deployERC721Bridgeable() and deployERC1155Bridgeable() as internal. This change will maintain the functionality while optimizing gas consumption and mitigating risks associated with DELEGATECALL.