ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Denial of Service via whitelist manipulation in `bridge`

mikb

Summary

The automatic whitelisting of new collections on L2 during withdrawals can be exploited to bloat the whitelist, potentially leading to increased gas costs and partial DOS.

Vulnerability Details

  1. In withdraw_auto_from_l1, new collections are automatically whitelisted, trough ensure_erc721_deployment:

fn withdraw_auto_from_l1(
ref self: ContractState,
from_address: felt252,
req: Request
) {
ensure_is_enabled(@self);
assert(self.bridge_l1_address.read().into() == from_address,
'Invalid L1 msg sender');
​
// TODO: recompute HASH to ensure data are not altered.
// TODO: Validate all fields the request (cf. FSM).
​
let collection_l2 = ensure_erc721_deployment(ref self, @req);
// ...
}
fn ensure_erc721_deployment(ref self: ContractState, req: @Request) -> ContractAddress {
// ...
// update whitelist if needed
let (already_white_listed, _) = self.white_listed_list.read(l2_addr_from_deploy);
if already_white_listed != true {
_white_list_collection(ref self, l2_addr_from_deploy, true);
self.emit(CollectionWhiteListUpdated {
collection: l2_addr_from_deploy,
enabled: true,
});
}
l2_addr_from_deploy
}

  1. An attacker can repeatedly initiate withdrawals with new collection addresses, bloating the whitelist.

Impact

  1. Increased gas costs for operations that iterate over the whitelist.

  2. Partial DOS of functions that rely on whitelist iterations.

Tools Used

Manual review

Recommendations

  1. Implement a process for adding new collections to the whitelist instead of automatic addition.

  2. Add a limit to the number of collections that can be whitelisted in a given time frame.

  3. Implement a mechanism to remove or deprecate unused whitelisted collections.

  4. Consider implementing a more gas-efficient data structure for managing the whitelist.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

n0kto Lead Judge
9 months ago
n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-collections-always-withelisted-on-both-chain-withdraw-impossible-collections-array-will-be-OOG

Likelyhood: High, once the whitelist option is disabled, collections will grow. Impact: High, withdraw won’t be possible because of Out-Of-Gas.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.