ArkProject: NFT Bridge

Summary

The setStarklaneL2Address function in the Starklane contract does not include verification to ensure that the provided L2 address is a valid contract. This omission could lead to interactions with invalid addresses, resulting in potential transaction failures or unintended behaviors in the protocol.

Vulnerability Details

The setStarklaneL2Address function is responsible for setting the _starklaneL2Address variable, which is later used in various protocol interactions. However, the function currently lacks a mechanism to verify that the provided L2 address corresponds to a valid smart contract.

Potential Issues:

• Incorrect or Malicious Address: Without verification, an incorrect or malicious address could be set, leading the protocol to attempt interactions with an address that is either non-existent or not a smart contract.

• Failed Interactions: Functions that rely on _starklaneL2Address may fail if the address does not represent a contract, causing transaction failures and possible disruptions in the protocol.

Impact

The lack of validation can cause critical protocol functions to fail if they attempt to interact with a non-contract address. This could lead to a range of issues, including stalled transactions, loss of funds, and reduced reliability of the protocol. The risk is particularly high in scenarios where the address is set incorrectly due to user error or malicious input.

Tools Used

Manual Code Review

Recommendations

Implement Contract Verification:

• Enhance the setStarklaneL2Address function by adding a check to ensure the address provided is a contract.

• Use the extcodesize opcode to verify the presence of bytecode at the provided address, confirming it is a contract.

Code Enhancement Example: