60,000 USDC
Submission Details
Severity:
Wrong CollectionL1 address used to cancelRequest.
Summary
Wrong CollectionL1 address used to cancelRequest.
Vulnerability Details
Under _cancelRequest wrong collectionL1 address is used to cancel a Request
function _cancelRequest(Request memory req) internal {
uint256 header = felt252.unwrap(req.header);
CollectionType ctype = Protocol.collectionTypeFromHeader(header);
address collectionL1 = req.collectionL1;
for (uint256 i = 0; i < req.tokenIds.length; i++) {
uint256 id = req.tokenIds[i];
_withdrawFromEscrow(ctype, collectionL1, req.ownerL1, id);
}
}
As we can see above req.collectionL1 is passed in _withdrawFromEscrow function to cancel the request, which is wrong since if we see under [withdrawToken]( https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Bridge.sol#L179C9-L201C90) function which takes token collection address and not req.collectionL1 address also mentioned in the comment of _withdrawFromEscrow [function](https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Escrow.sol#L57), which is fetched after verifying the mapping between the request addresses and the storage from _verifyRequestAddresses.
Impact
Wrong using of collectionL1 address, leads to always proceed _withdrawFromEscrow function wrongly.
Tools Used
Recommendations
use _verifyRequestAddresses under cancelRequest and use the return address from _verifyRequestAddresses under _withdrawFromEscrow.
Also check for zero address for collectionL1 address.
function _cancelRequest(Request memory req) internal {
uint256 header = felt252.unwrap(req.header);
CollectionType ctype = Protocol.collectionTypeFromHeader(header);
-- address collectionL1 = req.collectionL1;
++ address collectionL1 = _verifyRequestAddresses(req.collectionL1, req.collectionL2);
for (uint256 i = 0; i < req.tokenIds.length; i++) {
uint256 id = req.tokenIds[i];
_withdrawFromEscrow(ctype, collectionL1, req.ownerL1, id);
}
}
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.