ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The NFT can be bridged from the hard-fork chain after the source chain hard-fork

pks271

code: https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L78-L143

Summary

The NFT can be bridged from the hard-fork chain after the source chain hard-fork.

Vulnerability Details

Users can call depositTokens function to transfer NFT from the source chain to starknet chain. However, if the chain hard-fork, the NFT can be bridged to starknet chain from both the source chain and the hard-fork chain because there is no chain-id verification when calling the depositTokens function:

function depositTokens(
uint256 salt,
address collectionL1,
snaddress ownerL2,
uint256[] calldata ids,
bool useAutoBurn
)
external
payable
{
_depositIntoEscrow(ctype, collectionL1, ids);
​
req.tokenIds = ids;
​
uint256[] memory payload = Protocol.requestSerialize(req);
if (payload.length >= MAX_PAYLOAD_LENGTH) {
revert TooManyTokensError();
}
IStarknetMessaging(_starknetCoreAddress).sendMessageToL2{value: msg.value}(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload
);
...
}

As we can see, there is no any verification about the chain-id. Such that NFT holders can bridge their NFT from the hard fork chain to starknet chain after the source chain hard-fork, he also own the NFT in the source chain at the same time so he can double his NFT in such a way.

Although the possibility is low, the effect is enormous. See omni bridge vulnerability when Ethereum’s transition to the PoS chain.

Impact

NFT holders can double their NFT after the source chain hard-fork.

Tools Used

vscode, Manual Review

Recommendations

Add chain-id verification when calling the depositTokens function.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

pks271 Submitter
9 months ago
n0kto Lead Judge
9 months ago
n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.