Summary

The deploy_erc721_bridgeable() function in collection_manager.cairo lacks proper access control, allowing unauthorized entities to deploy multiple ERC721 bridgeable contracts. This could lead to the deployment of numerous ERC721 bridgeable contracts associated with the same L1 NFT address, causing potential disruptions and malicious activities.

Vulnerability Details

Description

The deploy_erc721_bridgeable() function is currently exposed without any restrictions, meaning anyone can call this function to deploy an ERC721 bridgeable contract. The function accepts the following parameters:

• class_hash: The class hash of the ERC721 contract to be deployed.

• salt: A value used to influence the deployment address.

• name: The descriptive name of the ERC721 collection.

• symbol: The abbreviated name of the ERC721 collection.

• base_uri: The base URI for the ERC721 metadata.

• bridge_address: The address of the bridge contract.

Without access control, an attacker can provide arbitrary values for these parameters, especially the bridge_address parameter, which can be set to a legitimate L1 bridge address to make the contract seem legitimate. This opens up several attack vectors, such as deploying multiple ERC721 bridgeable contracts that appear to be associated with a legitimate L1 collection, which can confuse users and potentially lead to exploitation.
Vulnerable code

Exploitation Scenario

1. Unauthorized Deployment: An attacker calls the deploy_erc721_bridgeable() function and provides a valid bridge_address from a well-known L1 bridge.

2. Duplicate Contracts: The attacker can deploy multiple ERC721 bridgeable contracts under the guise of being legitimate collections, all pointing to the same L1 NFT address or bridge address.

3. Malicious Intent: These unauthorized contracts could be designed to look and act similarly to legitimate ones, potentially tricking users into interacting with malicious contracts, leading to financial loss or data theft.

Example

Consider an L1 bridge address 0xABC...123 that is trusted by users. An attacker uses the deploy_erc721_bridgeable() function to deploy several ERC721 contracts that use this address. Users might believe these contracts are legitimate and interact with them, resulting in potential financial loss or other security issues.

Impact

Severity: High

1. Make the Function Internal: Restrict the deploy_erc721_bridgeable() function to internal calls only, preventing external users from invoking it directly.

2. Access Control with Role-Based Restrictions:

   • Use role-based access control (RBAC) to restrict this function to specific roles (e.g., only the bridge contract, contract owner, or admin should have the ability to deploy new ERC721 contracts).