ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Tokens Bridged from L1 can be lost forever on L2

praise03

Summary

Bridged tokens can be lost forever on the L2 due to the depositToken function's failure to check verify if ownerL2 address is the 0 address

Vulnerability Details

if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) {
revert CairoWrapError();
}

The above line of code is used to verify if the L2 address provided is a valid address, but fails to check if the address is equates to 0. Meaning an nft can be bridged to the L2's 0 address and hence be burnt or lost forever.

Impact

Corresponding NFT on L2 is lost forever

Tools Used

Manual Review

Recommendations

Add this line of code to the depositToken function in Bridge.sol

require(snaddress.unwrap(ownerL2) != 0x0, "Cannot Bridge to Zero Address");
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.