ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Inability to bridge back NFTs due to unupdated L1->L2 mapping

mikb

Summary

When a new NFT collection is bridged from L1 to L2, the L2 contract updates its mapping, but the L1 contract does not. This asymmetry prevents users from bridging their NFTs back to L1, as the verification process fails due to mismatched mappings.

Vulnerability Details

In bridge.cairo, when a new collection is deployed, the mappings are updated:

self.l1_to_l2_addresses.write(l1_req, l2_addr_from_deploy);
self.l2_to_l1_addresses.write(l2_addr_from_deploy, l1_req);

However, there's no corresponding update on the L1 side.
Then, when attempting to bridge back, the _verifyRequestAddresses function in CollectionManager.sol will fail:

address l1Mapping = _l2ToL1Addresses[collectionL2];
uint256 l2Mapping = snaddress.unwrap(_l1ToL2Addresses[l1Req]);
​
if (l2Req > 0 && l1Req > address(0)) {
if (l1Mapping != l1Req) {
revert InvalidCollectionL1Address();
} else if (l2Mapping != l2Req) {
revert InvalidCollectionL2Address();
} else {
// All addresses match, we don't need to deploy anything.
return l1Mapping;
}
}

Impact

Users cannot bridge back NFTs from newly deployed collections on L2 to L1, because they are locked on the L2 side, leading to loss of assets or inability to use them on the original chain.

Tools Used

Manual review

Recommendations

Implement a mechanism to update the L1 contract's mappings when a new collection is deployed on L2:

  • This could be done through a message from L2 to L1 after successful deployment.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-first-bridgeof-a-collection-L1<->L2-do-not-sync-addresses

Likelyhood: High, any collections bridged, without bridge owner action, will be unable to bridge back. Impact: High, L2 -> L1 tokens will be stuck in the bridge. L1 -> L2 will need to ask for a cancellation.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.