ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

No Protection of Uninitialized Implementation Contracts From Attacker

0xshoonya

Summary

The Starklane contract's initialize() function, which sets critical parameters including ownership, lacks access control. This vulnerability allows any user to potentially front-run the deployment transaction and gain unauthorized control of the contract.

Vulnerability Details

The initialize() function in the Starklane contract is responsible for setting up crucial contract parameters:
Bridge.sol#L44-L66

function initialize(
bytes calldata data
)
public
onlyInit
{
(
address owner,
IStarknetMessaging starknetCoreAddress,
uint256 starklaneL2Address, //address of L2 bridge @audit
uint256 starklaneL2Selector
) = abi.decode(
data,
(address, IStarknetMessaging, uint256, uint256)
);
_enabled = false;
_starknetCoreAddress = starknetCoreAddress;
​
_transferOwnership(owner);
​
setStarklaneL2Address(starklaneL2Address);
setStarklaneL2Selector(starklaneL2Selector);
}

This function is protected by the onlyInit modifier, which ensures it can only be called once:

modifier onlyInit() {
address impl = _getImplementation();
require(!_initializedImpls[impl], "Already init");
_initializedImpls[impl] = true;
_;
}

However, there's no access control on who can call this function for the first time. An attacker could monitor the mempool for the deployment transaction and front-run it with their own call to initialize(), setting themselves as the owner and set critical parameters like starknetCoreAddress, starklaneL2Address, and starklaneL2Selector.

Impact

An attacker could gain full ownership and control of the contract.

Tools Used

Manual Review

Recommendations

To prevent the implementation contract from being used, you should invoke the _disableInitializers() function from Openzeppelin in the constructor to automatically lock it when it is deployed:

constructor() {
_disableInitializers();
}
Updates

Lead Judging Commences

n0kto Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-initialize-on-implementation

Likelyhood: Low/Medium Impact: Very low, the attacker can at most run the protocol on their side and lead a phishing campaign with an address deployed by Ark.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!