ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing zero address check in deposit_tokens() in bridge.cairo

rilwanwild

Summary

In bridge.cairo, the deposit_tokens() function does not implement a zero address check for the owner_l1 field. If a user provides a zero address for this field, this may result in the user's NFT being burned as it is sent to the zero address on Ethereum.

Vulnerability details

In bridge.cairo, there is a check to ensure that the owner_l1 field provided is a valid Ethereum address. However, this check would still be passed even if a zero address is provided.

fn deposit_tokens(
ref self: ContractState,
salt: felt252,
collection_l2: ContractAddress,
owner_l1: EthAddress,
token_ids: Span<u256>,
use_withdraw_auto: bool,
use_deposit_burn_auto: bool,
) {
// some other code
}
​
#[derive(Copy, Drop, Hash, PartialEq)]
pub struct EthAddress {
address: felt252,
}

It would be possible to pass a zero address (0x0) as the owner_l1 parameter. The EthAddress struct doesn't have any built-in validation to prevent this.

Impact

This could result in users unintentionally burning their NFT during the bridging process, if they pass in a zero address as the owner_l1 field. Thier NFT would be lost forever and irrecoverable.

Recommendation

Implement a check to ensure that zero address is not provided for the owner_l1 field.

fn deposit_tokens(
ref self: ContractState,
salt: felt252,
collection_l2: ContractAddress,
owner_l1: EthAddress,
token_ids: Span<u256>,
use_withdraw_auto: bool,
use_deposit_burn_auto: bool,
) {
// Check if owner_l1 is a zero address
assert(owner_l1.address != 0, 'Owner address cannot be zero');
​
// Rest of the function logic
// ...
}

Tools Used

Manual review

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.