Summary

The withdrawTokens function mints new tokens whenever a token is not found in escrow, without proper checks or limitations. This can lead to unauthorized token minting and potential inflation of the token supply.

Vulnerability Details

In the withdrawTokens function, there's a loop that processes each token ID in the request. For each token, it attempts to withdraw it from escrow. If the token is not in escrow (indicated by wasEscrowed being false), the function mints a new token instead of raising an error. This behavior can be exploited to mint arbitrary numbers of tokens without proper authorization or limits.

Impact

• Compromised Bridge Integrity: The vulnerability undermines the fundamental purpose of the bridge, which is to transfer existing tokens between chains. By minting new tokens instead of transferring escrowed ones, the bridge's core functionality is corrupted.

• Uncontrolled Token Supply Inflation: Exploiting this vulnerability allows for the creation of an arbitrary number of new tokens on the destination chain. This uncontrolled minting can lead to severe inflation of the token supply, potentially far exceeding the intended total supply of the token ecosystem.

• Economic Imbalance Between Chains: As new tokens are minted on one chain without being locked on the other, it creates a significant imbalance in the token distribution across the bridged networks. This disparity can lead to arbitrage opportunities and undermine the economic equality that the bridge aims to maintain.

• Devaluation of Existing Tokens: The artificial increase in token supply can lead to a substantial devaluation of existing tokens held by legitimate users. This devaluation can erode trust in the token and the bridge system as a whole.

Tools Used

Manual Review

Recommendations

• Add a limit to the number of tokens that can be minted in a single transaction or by a single address.

• Implement strict checks to ensure that only authorized parties can initiate token minting.

• Instead of minting new tokens when not found in escrow, consider reverting the transaction with an appropriate error message.

• Implement a whitelist or role-based access control for minting operations.

• Add events to log minting operations for better transparency and auditability.