ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Replay Attack on Deposit Requests

0xethsol

Summary

The depositTokens function constructs a request hash and sends it to Starknet, but it does not track or store these hashes. This oversight makes the contract vulnerable to replay attacks.

Vulnerability Details

The depositTokens function generates a request hash based on the provided inputs but does not save this hash in storage. Without tracking these hashes, a malicious actor can replay the same request, leading to potential duplicate deposits.

Impact

Replay attacks could result in multiple unintended token deposits or withdrawals, affecting the accuracy and reliability of token transfers between L1 and L2.

Tools Used

Manual Code Review

Recommendations

Implement a mechanism to store processed request hashes. For instance, you can use a mapping to keep track of used request hashes:

mapping(bytes32 => bool) private _processedRequestHashes;
​
function _isRequestProcessed(bytes32 requestHash) internal view returns (bool) {
return _processedRequestHashes[requestHash];
}
​
function _markRequestAsProcessed(bytes32 requestHash) internal {
_processedRequestHashes[requestHash] = true;
}
​

Update the depositTokens function to use these methods to prevent replay attacks:

req.hash = Protocol.requestHash(salt, collectionL1, ownerL2, ids);
if (_isRequestProcessed(req.hash)) {
revert RequestAlreadyProcessedError();
}
_markRequestAsProcessed(req.hash);
​
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

invalid-replay-attack-hash-not-stored-nonce-not-used

There is no impact here: Transaction cannot be replayed because the blockchain use the nonce in the signature. Hash is computed on-chain. Using or trying to have the same hash mean you need to buy the token, and they will be sent to their origin owner. Why an attacker would buy tokens to give them back ? No real impact.

Appeal created

0xethsol Submitter
11 months ago
n0kto Lead Judge
11 months ago
n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

invalid-replay-attack-hash-not-stored-nonce-not-used

There is no impact here: Transaction cannot be replayed because the blockchain use the nonce in the signature. Hash is computed on-chain. Using or trying to have the same hash mean you need to buy the token, and they will be sent to their origin owner. Why an attacker would buy tokens to give them back ? No real impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.