ArkProject: NFT Bridge

Summary

The L1 bridge contract's cancelRequest function directly calls cancelL1ToL2Message without verifying if a cancellation request has been initiated or if the required waiting period has elapsed. This bypasses critical security checks implemented in the StarknetMessaging contract.

Vulnerability Details

The cancelRequest function in the bridge contract calls cancelL1ToL2Message on the StarknetMessaging contract without first ensuring that:

1. A cancellation request has been initiated via startL1ToL2MessageCancellation.

2. The required waiting period (defined by messageCancellationDelay) has passed.

According to Starknet Docs, user should call this function after calling the startL1ToL2MessageCancellation function and the time between the calls to these two functions must be at least the number of seconds defined by the messageCancellationDelay function.

These checks are present in the StarknetMessaging contract but are not enforced at the bridge contract level, leading leading to unexpected reverts and a poor user experience.

Moreover, currently there is no function available for users to check the status of their cancellation request and the remaining wait time.

Impact

Missing critical cancellation checks may lead to unexpected transaction failures and poor user experience, as the bridge contract does not ensure the proper sequence and timing required for message cancellation.

Tools Used

Manual Review

Recommendations

1. Modify cancelRequest to check if a cancellation has been initiated and if the required time has passed before calling cancelL1ToL2Message.

2. Add a function for users to check the status of their cancellation request and the remaining wait time.