ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Early break in whitelist retrieval loop

mikb

Summary

In bridge.cairo, get_white_listed_collections may prematurely break its loop when encountering a disabled collection, potentially omitting valid whitelisted collections that come after it in the list.

Vulnerability Details

In get_white_listed_collections:

fn get_white_listed_collections(self: @ContractState) -> Span<ContractAddress> {
let mut white_listed = array![];
let mut current = self.white_listed_head.read();
loop {
if current.is_zero() {
break;
}
let (enabled, next) = self.white_listed_list.read(current);
if !enabled {
break; // could cause an early break
} else {
white_listed.append(current);
current = next;
}
};
white_listed.span()
}

The loop breaks as soon as it encounters a disabled collection. However, _white_list_collection function suggests that disabled collections might exist in the middle of the list:

loop {
let (_, next) = self.white_listed_list.read(prev);
if next.is_zero() {
break;
}
let (active, _) = self.white_listed_list.read(next);
if !active {
break;
}
prev = next;
};

Impact

If a disabled collection exists in the middle of the list, all subsequent whitelisted collections will be omitted from the result, leading to inconsistent whitelist enforcement across different parts of the system.

Proof of Concept
Consider a whitelist state:
A (enabled) -> B (disabled) -> C (enabled) -> D (enabled)

get_white_listed_collections would only return [A], omitting [C] and [D].

Tools Used

Manual review

Recommendations

Modify get_white_listed_collections function to continue iterating even when it encounters a disabled collection:

fn get_white_listed_collections(self: @ContractState) -> Span<ContractAddress> {
let mut white_listed = array![];
let mut current = self.white_listed_head.read();
loop {
if current.is_zero() {
break;
}
let (enabled, next) = self.white_listed_list.read(current);
if enabled {
white_listed.append(current);
}
current = next;
};
white_listed.span()
}
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.