Summary

The depositTokens function in the Starklane contract in Bridge.sol does not correctly handle payloads that exceed the MAX_PAYLOAD_LENGTH limit, allowing for potential exploitation or rejection of legitimate transactions.

Vulnerability Details

In the depositTokens function, after serializing the request data into a payload, the function checks if the payload length is greater than or equal to MAX_PAYLOAD_LENGTH. If it is, the function reverts with a TooManyTokensError. However, this check is problematic because:

• The condition checks for >= MAX_PAYLOAD_LENGTH instead of > MAX_PAYLOAD_LENGTH. This could lead to valid requests being rejected if they exactly meet the MAX_PAYLOAD_LENGTH threshold.

• The threshold value (MAX_PAYLOAD_LENGTH) is hardcoded and does not account for varying requirements or potential changes.

Impact

• Legitimate Transactions Rejected: Requests that have payloads exactly equal to MAX_PAYLOAD_LENGTH will be incorrectly rejected, affecting the functionality of the contract and potentially leading to denial of service for users.

• Potential Exploitation: The rigid payload size limit could be exploited to prevent certain transactions, depending on how the payload size is handled in practice.

Tools Used

Manual Review

Recommendations