ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Current Escrow implementation does not properly support ERC1155 Tokens

praise03

Summary

User deposits in ERC1155 NFTs can be locked forever

Vulnerability Details

The way the bridge handels erc1155 NFTs fails to account for the fact that a single token ID can be owned by multiple users and have more than 1 supply.

//used to map tokens to the token owner in Escrow
_escrow[collection][id] = msg.sender;

The above line of code maps a token ID of a particular collection to an address as the owner. But for ERC1155 nfts where multiple users can own the same token ID, mapping it this way means only the latest depositor would own the NFT and all previously deposited NFTs are unaccounted for.

//used to update _escrow mapping in withdrawTokens
_escrow[collection][id] = address(0x0);

This above line used in withdrawing tokens from the L1 bridge doesnt work properly for ERC1155 NFTs because, if one of the owners of a particular token ID withdraws that token, the mapping is reset and all other previous depositors are unable to withdraw.

Impact

Irregularities in accounting for deposited and withdrawn tokens can lead to NFTs being locked indefinitely.

Tools Used

Manual Review

Recommendations

Consider creating a separate mapping for ERC1155 NFTs that include a separate map for each owner of a particular tokenID

//a possible solution
//maps collection addr to owner addr to token id to token id count.
mapping(address => mapping(address => mapping(uint256 => uint256))) _erc1155Escrow
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

invalid-ERC1155-not-in-scope

```compatibilities: Blockchains: - Ethereum/Starknet Tokens: - [ERC721](www.tokenstandard.com) ``` ``` function depositTokens( uint256 salt, address collectionL1, snaddress ownerL2, uint256[] calldata ids, bool useAutoBurn ) external payable { if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) { revert CairoWrapError(); } if (!_enabled) { revert BridgeNotEnabledError(); } CollectionType ctype = TokenUtil.detectInterface(collectionL1); if (ctype == CollectionType.ERC1155) { @> revert NotSupportedYetError(); } … } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.