ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Delay and risk for users in Request Cancellation Process

m4k2xmk

Overview

The Ark Project bridge contract (Bridge.sol) implements a two-step cancellation process for cross-chain requests. However, the initiation of this process is restricted to the contract owner, introducing a single point of failure that could potentially lead to user funds being locked indefinitely.

Vulnerability Details

Location

Function: startRequestCancellation
File: Bridge.sol

Description

The startRequestCancellation function is currently protected by the onlyOwner modifier:

function startRequestCancellation(
uint256[] memory payload,
uint256 nonce
) external onlyOwner {
// Function implementation
}

This creates a dependency on the contract owner for initiating cancellations.

Impact

  1. Delayed Cancellations: Users may experience significant delays in cancelling failed or stuck transactions if the owner is unresponsive.

  2. User Trust: The reliance on a single entity for crucial operations may negatively impact user confidence in the bridge.

Mitigation

Recommended Fix

Remove the onlyOwner modifier from the startRequestCancellation function:

function startRequestCancellation(
uint256[] memory payload,
uint256 nonce
- ) external onlyOwner {
+ ) external {
IStarknetMessaging(_starknetCoreAddress).startL1ToL2MessageCancellation(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
Request memory req = Protocol.requestDeserialize(payload, 0);
emit CancelRequestStarted(req.hash, block.timestamp);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.