ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of ERC1155 Token supply verification in Escrow contract

akay

Summary

The StarklaneEscrow contract in Escrow.sol does not verify the supply of ERC1155 tokens being transferred in or out of escrow. This could lead to unexpected behavior when dealing with ERC1155 tokens that have a supply other than 1.

Vulnerability Details

The contract assumes that each ERC1155 token has a supply of exactly 1, but it doesn't verify this assumption. This is evident in two key functions:

In _depositIntoEscrow:

IERC1155(collection).safeTransferFrom(msg.sender, address(this), id, 1, "");

In _withdrawFromEscrow:

IERC1155(collection).safeTransferFrom(from, to, id, 1, "");

Both functions transfer exactly 1 token, regardless of the actual supply. The contract also includes a TODO comment acknowledging this issue:

// TODO: check the supply is exactly one.

Impact

If an ERC1155 token has a supply greater than 1, the contract will only escrow and return a single token, potentially leaving additional tokens unaccounted for. It also doesn't handle cases where the supply might be 0, which could lead to failed transactions or inconsistent state and users cannot escrow or withdraw multiple copies of the same ERC1155 token ID.

Tools Used

Manual code review

Recommendations

Add a function to check the supply of ERC1155 tokens before escrowing them. You can use the balanceOf function from the ERC1155 interface:

function _checkERC1155Supply(address collection, uint256 id, address owner) internal view returns (uint256) {
return IERC1155(collection).balanceOf(owner, id);
}

Also modify the _depositIntoEscrow and _withdrawFromEscrow functions to handle variable supplies:

function _depositIntoEscrow(
CollectionType collectionType,
address collection,
uint256[] memory ids,
uint256[] memory amounts // New parameter for ERC1155
) internal {
// ... existing code ...
if (collectionType == CollectionType.ERC1155) {
uint256 supply = _checkERC1155Supply(collection, id, msg.sender);
require(supply >= amounts[i], "Insufficient token supply");
IERC1155(collection).safeTransferFrom(msg.sender, address(this), id, amounts[i], "");
}
// ... rest of the function ...
}
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

invalid-ERC1155-not-in-scope

```compatibilities: Blockchains: - Ethereum/Starknet Tokens: - [ERC721](www.tokenstandard.com) ``` ``` function depositTokens( uint256 salt, address collectionL1, snaddress ownerL2, uint256[] calldata ids, bool useAutoBurn ) external payable { if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) { revert CairoWrapError(); } if (!_enabled) { revert BridgeNotEnabledError(); } CollectionType ctype = TokenUtil.detectInterface(collectionL1); if (ctype == CollectionType.ERC1155) { @> revert NotSupportedYetError(); } … } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.