ArkProject: NFT Bridge

Summary

The Starklane contract is designed to manage a whitelist of addresses but currently lacks functionality to remove addresses once they have been added. This oversight can lead to potential security risks and operational challenges, particularly if an address needs to be delisted due to unforeseen circumstances.

Vulnerability Details

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L284

The contract does not provide a mechanism for removing addresses from the whitelist.

If an address becomes compromised or behaves maliciously, it cannot be removed from the whitelist, posing a security risk.

Impact

A compromised or malicious address on the whitelist can exploit its status to perform unauthorized actions, potentially affecting the integrity and security of the system.

Without the ability to remove addresses, managing and maintaining an accurate and secure whitelist becomes difficult.

The inability to adapt quickly in response to security incidents can lead to prolonged exposure and potential exploitation.

Failure to address compromised addresses promptly may damage trust in the system's reliability and security.

Tools Used

Manual review

Recommendations

Implement Removal Functionality:

• Introduce a function that allows for removal of addresses from the whitelist.

• Ensure this function is protected by appropriate access control (e.g., onlyOwner) to prevent unauthorized use.