ArkProject: NFT Bridge

Summary

The Starknet bridge contract's withdraw_auto_from_l1 function fails to update the escrow state after transferring tokens, leading to potential issues with token withdrawals

Vulnerability Details

In the Starknet bridge contract, the escrow mapping tracks the ownership of tokens that are temporarily held by the bridge during cross-chain operations.

During a token deposit on L2, the deposit_tokens function is called:

which in turn calls escrow_deposit_tokens to update the escrow mapping:

However, when a token withdrawal is initiated via l1_handler_transaction through the withdraw_auto_from_l1 function, the contract checks if the token is escrowed by verifying if the escrow mapping contains a non-zero address. If it is escrowed, it transfers the token back to th user on L2:

The issue is, after this transfer, there's no code to update the escrow state. The escrow mapping is not cleared or updated after the token is transferred out of escrow.

This means the token's escrow entry remains in the mapping, indicating that the token is still held by the bridge, even though it has already been transferred back to the user.

Thus, escrow state gets out-of-sync with the actual state of tokens in the bridge.

Impact

If a token that was previously withdrawn is deposited again, subsequent legitimate withdrawal attempts will still detect the token as being escrowed. This might cause the contract to attempt another transfer instead of minting new tokens. If the bridge does not have possession of the token at that point, the withdrawal process could fail, effectively blocking the user from retrieving their tokens.

Tools Used

VSCode

Recommendations

Add the following line to the withdraw_auto_from_l1 function