ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Check for zero address in constructor for `bridge_admin` and `bridge_l1_address` in bridge.cairo

oxfranko

Summary

In bridge.cairo, there is no checks for a zero address on key parameters.

Vulnerability Details

The author does not check for the zero address at the constructor level which I think is wrong, as important as the bridge contract is. Not checking for the zero address could pose a potential risk to the contract.

Impact

The assumption could lead to a scenario where an attacker could sneak in a zero address on the bridge_admin or the bridge_l1_address.

Tools Used

Manual review

Recommendations

Check for zero addresses in bridge.cairo constructor.

assert!(!bridge_admin.is_zero(), "Invalid admin address");
assert!(!bridge_l1_address.is_zero(), "Invalid L1 address");
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.