ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Cairo bridge does not prevent user from making a withdrawAuto request

haxatron

On L2 -> L1 withdrawals, messages with withdrawAuto in the header set will always revert.

if (Protocol.canUseWithdrawAuto(header)) {
// 2024-03-19: disabled autoWithdraw after audit report
// _consumeMessageAutoWithdraw(_starklaneL2Address, request);
revert NotSupportedYetError();
}

However, it is still possible to set this value in the Cairo bridge, which means if user sets this value, their NFT withdrawal will revert until protocol is upgraded and enables withdrawAuto requests.

The solution would be to continue the transaction via normal Starknet consumption for now if withdrawAuto header is set or disallow the withdrawAuto header from being set in the Cairo bridge.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-auto_withdrawn-L2-NFT-stuck

Impact: High, token will be stuck in L2 bridge. Likelyhood: Very low, option is available in L2 but has been disabled since March on L1, would be almost a user error.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.