ArkProject: NFT Bridge

Summary

The withdrawTokens function in the L1 bridge contract includes a call to the _whiteListCollection function, which automatically whitelists a newly deployed ERC721 collection if it does not already exist. This process occurs without first checking if the whitelist is globally enabled, potentially leading to unintended or unauthorized collections being added to the whitelist.

Vulnerability Details

The vulnerability arises from the following code in the withdrawTokens function:

The _whiteListCollection function is called to automatically add the newly deployed collection to the whitelist. However, the code does not verify whether the whitelist is globally enabled before making this call.

Have a look at the _whiteListCollection function:

This is problematic because:

In the withdrawTokens Function: If the whitelist is globally disabled, the automatic whitelisting of a collection should not occur. By failing to check the global whitelist status, the function risks adding collections to the whitelist without the owner's explicit intention, potentially leading to security vulnerabilities.

In the whiteList Function: Similarly, the whiteList function does not check if the whitelist is enabled before updating the whitelist status for a given collection. This lack of verification could result in inconsistent whitelist states, where collections are added or removed from the whitelist without regard for the global whitelist policy.

Impact

Collections could be whitelisted automatically when the whitelist is globally disabled, leading to unauthorized collections being permitted when the whitelist is later enabled.

Tools Used

Manual Review

Recommendations

To mitigate this issue, the contract should include a check to verify whether the global whitelist is enabled before adding or removing collections from the whitelist. The code should be updated as follows:

In the withdrawTokens Function:

In the whiteList Function: