ArkProject: NFT Bridge

Summary

The use_deposit_burn_auto parameter is passed from the Starknet bridge to the Ethereum bridge, but it is not utilized in the Ethereum bridge's Solidity code. If this parameter is not used, it should be removed to avoid confusion. Additionally, if there are plans to implement an auto burn feature, it should include a check to ensure that only synthetic tokens are burned and not native ones to prevent the permanent loss of NFTs.

Vulnerability Details

The use_deposit_burn_auto parameter is passed from the Starknet bridge to the Ethereum bridge, where it is intended to control whether automatic burning of tokens should occur. However, the current Solidity implementation of the Ethereum bridge ignores the useAutoBurn parameter, rendering the use_deposit_burn_auto parameter redundant. This can lead to confusion for developers and users, as the parameter's purpose is not reflected in the Solidity code. Additionally, if an auto burn feature is to be implemented in the future, there is a risk of burning native tokens, which could lead to irreversible loss of NFTs if not properly checked.

Impact

1. Redundant Parameter: The presence of an unused parameter creates confusion and potential misconfiguration, as developers may expect it to have an effect based on its presence.

2. Potential for Token Loss: If auto burn functionality is implemented without appropriate checks, native tokens could be mistakenly burned, leading to a permanent loss of NFTs.

3. Increased Complexity: Unused parameters add unnecessary complexity to the code, making it harder to maintain and understand.

Recommendations

1. Remove Unused Parameter: If the use_deposit_burn_auto parameter is not intended to be used in the Ethereum bridge, remove it from the code to reduce confusion and simplify the contract.

2. Implement Auto Burn Safeguards: If implementing an auto burn feature, ensure that it includes checks to differentiate between synthetic and native tokens. This will prevent the accidental burning of native tokens.

3. Review Parameter Usage: Review the entire codebase to ensure that any parameters passed between the Starknet and Ethereum bridges are properly utilized. Ensure that there is no ambiguity regarding their purpose and effect.