Summary

The initialize function of the contract sets the starknetCoreAddress without verifying that it is a valid, non-zero contract address. Since their is no other function to set the starknetCoreAddress after initialization, any mistake or malicious input can lead to the contract being permanently compromised or non-functional.

Vulnerability Details

In the provided initialize function, the starknetCoreAddress is set directly from the input data without any validation checks to ensure that it is a valid contract address. This presents several risks:

1. Zero Address Risk: If starknetCoreAddress is set to the zero address (0x0000000000000000000000000000000000000000), either intentionally or not, it would likely cause the contract to malfunction since any interactions with this address would fail.

2. Non-Contract Address Risk: If starknetCoreAddress is set to an address that is not a smart contract, any calls made to this address under the assumption that it is a contract would fail, leading to errors or failures in the contract's functionality.

3. Immutable State: Once the starknetCoreAddress is set during initialization, it cannot be changed as their is not such functionality to reset it. This makes it crucial to ensure that the address is valid at the time of initialization to avoid permanently compromising the contract.

Impact

If the starknetCoreAddress is set to an invalid or incorrect address:

• Operational Failure: The contract could fail to interact with the StarkNet protocol as intended, leading to loss of functionality.

• Irreversible State: Since the address is immutable post-initialization, any error in setting this address cannot be corrected, potentially rendering the contract useless.

Tools Used

Manual code review

Recommendations

Validation of starknetCoreAddress:

• Add a check to ensure that starknetCoreAddress is not the zero address.

• Verify that starknetCoreAddress is a contract address by checking its code size:

  require(starknetCoreAddress != address(0), "Invalid StarkNet core address");

  uint32 size;

  assembly {

  size := extcodesize(starknetCoreAddress)

  }

  require(size > 0, "StarkNet core address is not a contract");

  ​

  Consider adding a function to update starknetCoreAddress:

  • If possible, consider adding a function that allows the contract owner to update starknetCoreAddress in case it was incorrectly set during initialization.