Summary

The function withdraw_auto_from_l1 lacks a check on req, allowing an attacker to forge req.

Vulnerability Details

https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/starknet/src/bridge.cairo#L129-L181

The function withdraw_auto_from_l1 is used to withdraw tokens from L1. The parameter req contains all the key information, such as address, token ids, etc. However, the function does not check whether req is valid. This allows attackers to forge req and steal tokens.

Impact

Attackers can forge request to steal tokens.

Tools Used

Vscode

Recommendations

Check the validity of req.