ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unintended ether sent to contract will stuck forever.

kaifahmed

Summary

The depositTokens() is a payable function which sends a msg.value to sendMessageToL2(), now this functions uses the msg.value amount as a value and increament 1 in that and save in the mapping.

l1ToL2Messages()[msgHash] = msg.value + 1;

Vulnerability Details

The sendMessageToL2 function also checks that eth send to the contract should be in a valid range

require(msg.value > 0, "L1_MSG_FEE_MUST_BE_GREATER_THAN_0");
require(msg.value <= getMaxL1MsgFee(), "MAX_L1_MSG_FEE_EXCEEDED");

Which makes no sense, the valid getMaxL1MsgFee is 1 ether set in contract.
the contract does not do anything with these ethers and there is no mechanism to retrive these ethers back from contract, similar is the case with withdrawTokens() function.

Impact

Eth send to Bridge contract will be stuck forever

Tools Used

manual code review

Recommendations

Implement a mechanism to send eth back to user after the execution of deposit function, or atleast at the time of request cancellation.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Appeal created

kaifahmed Submitter
10 months ago
n0kto Lead Judge
10 months ago
n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.