ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

DOS of `withdraw_auto_from_l1` function on starknet side

m4k2xmk

Summary

The automatic whitelisting of new collections on L2 during withdrawals can be exploited to bloat the whitelist, potentially leading to increased gas costs and partial DOS.

Vulnerability Details

In withdraw_auto_from_l1, new collections are automatically whitelisted.

This is done trough ensure_erc721_deployment :

#[l1_handler]
fn withdraw_auto_from_l1(
ref self: ContractState,
from_address: felt252,
req: Request
) {
ensure_is_enabled(@self);
assert(self.bridge_l1_address.read().into() == from_address,
'Invalid L1 msg sender');
​
// TODO: recompute HASH to ensure data are not altered.
// TODO: Validate all fields the request (cf. FSM).
​
let collection_l2 = ensure_erc721_deployment(ref self, @req);
​
...
}
fn ensure_erc721_deployment(ref self: ContractState, req: @Request) -> ContractAddress {
​
...
​
// update whitelist if needed
let (already_white_listed, _) = self.white_listed_list.read(l2_addr_from_deploy);
if already_white_listed != true {
_white_list_collection(ref self, l2_addr_from_deploy, true);
self.emit(CollectionWhiteListUpdated {
collection: l2_addr_from_deploy,
enabled: true,
});
}
l2_addr_from_deploy
}

An attacker can repeatedly initiate withdrawals with new collection addresses, bloating the whitelist.

In any case this will naturally growth over time and impact the gas cost of each new collection on the starknet side.

Impact

Increased gas costs for operations that iterate over the whitelist.
Partial DOS of functions that rely on whitelist iterations.

Tools Used

Manual review

Recommendations

  1. Implement a gas-efficient data structure for whitelist checks:

    • Consider using a mapping for O(1) lookup instead of array iteration

    • Explore Merkle tree validation for whitelist proofs

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-collections-always-withelisted-on-both-chain-withdraw-impossible-collections-array-will-be-OOG

Likelyhood: High, once the whitelist option is disabled, collections will grow. Impact: High, withdraw won’t be possible because of Out-Of-Gas.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.