ArkProject: NFT Bridge

Overview

The Starklane contract suffers from an architectural flaw where the _collections array grows indefinitely as new collections are added, without a corresponding mechanism to remove unused or un-whitelisted collections. This unbounded growth poses a significant risk of gas limit exhaustion in functions that iterate over this array, potentially leading to a denial of service for critical contract functionalities.

Vulnerability Details

Location

Functions: _whiteListCollection, getWhiteListedCollections and thus withdrawToken.
File: Bridge.sol

Description

1. Collection Addition:
   In the _whiteListCollection function, new collections are unconditionally added to the _collections array:

   if (toAdd) {

   _collections.push(collection);

   }

2. Whitelist Iteration:
   The getWhiteListedCollections function iterates over the entire _collections array:

   for (uint256 i = 0; i < nbElem; ++i) {

   address cur = _collections[i];

   if (_whiteList[cur]) {

   ret[offset] = cur;

   offset += 1;

   }

   }

3. Lack of Removal Mechanism:
   There is no implemented functionality to remove collections from the _collections array when they are un-whitelisted or become obsolete.

Impact

1. Gas Limit Exhaustion: As the protocol matures and more collections are added, the _collections array will grow indefinitely. This growth will increase the gas cost of functions that iterate over this array, eventually leading to out-of-gas errors.

2. Denial of Service: Critical functionalities that depend on processing the entire collections list may become inoperable due to excessive gas consumption.

3. Scalability Issues: The protocol's ability to add new collections will be severely limited over time.

4. Increased Operational Costs: Users may face higher transaction fees for operations involving whitelist checks.

Reproduction Steps

1. Add a large number of collections to the whitelist over an extended period.

2. Attempt to call getWhiteListedCollections or other functions that iterate over _collections.

3. Observe increasing gas costs and eventual transaction failures due to out-of-gas errors.

Mitigation

Recommended Fixes

1. Implement a removal mechanism:

   function removeFromWhitelist(address collection) external onlyOwner {

   // Remove from _whiteList mapping

   _whiteList[collection] = false;

   // Remove from _collections array

   for (uint256 i = 0; i < _collections.length; i++) {

   if (_collections[i] == collection) {

   _collections[i] = _collections[_collections.length - 1];

   _collections.pop();

   break;

   }

   }

   }

2. Modify _whiteListCollection to handle both addition and removal:

   function _whiteListCollection(address collection, bool enable) internal {

   if (enable && !_whiteList[collection]) {

   _collections.push(collection);

   } else if (!enable && _whiteList[collection]) {

   // Implement removal logic

   }

   _whiteList[collection] = enable;

   }

Additional Considerations

1. Implement a maximum cap on the number of whitelisted collections.

2. Consider using a more gas-efficient data structure for storing and querying whitelisted collections.