ArkProject: NFT Bridge

Summary

The _collections array in the Starklane contract grows indefinitely as new collections are added, without a mechanism to remove unused collections. This could lead to out-of-gas errors in functions that iterate over this array, potentially causing a denial of service.

Vulnerability Details

In the _whiteListCollection function, new collections are added to the _collections array:

Then, getWhiteListedCollections iterates over the entire _collections array:

Thus, there is no mechanism to remove collections from the _collections array when they are no longer whitelisted.

Impact

As the protocol is used over time and more collections are added, the _collections array will grow indefinitely, leading to DoS of protocol functionality that relies on iterating over all collections.

Tools Used

Manual review

Recommendations

1. Implement a function to remove unused collections from the _collections array.

2. Modify the _whiteListCollection function to remove collections when they are un-whitelisted.

3. Implement a pagination mechanism for getWhiteListedCollections to allow retrieval of subsets of the whitelist.