ArkProject: NFT Bridge

Summary

Hash that comes with the request object on bridge.cairo contract is not recomputed in the withdraw_auto_from_l1 function thus not ensuring data integrity.

Vulnerability Details

Check summary. This feature is yet to be written but it is necessary to point it out since the code might end up in production as is.

Code snippet

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L138C1-L138C64

Impact

Request object CAN be altered when coming to starknet part of the bridge. Data integrity is not ensured.

Tools Used

Manual review

Recommendations

Recompute hash with the data that comes in the request object. Make sure it matches the one emitted in Ethereum event on Bridge.sol contract.