ArkProject: NFT Bridge

Summary

The current implementation of the withdrawal process in the L1 bridge contract automatically adds the associated NFT collection to a whitelist. However, the algorithm used for this whitelisting process has a time complexity of O(N), meaning that as the number of whitelisted NFT collections grows, the gas required for the operation increases significantly. Eventually, this will lead to a situation where the gas required exceeds the block gas limit, effectively causing a permanent Denial of Service (DoS) for the withdrawal feature.

Vulnerability Details

The code snippet above shows the implementation of the _whiteListCollection function. This function is invoked in two main scenarios:

• When users bridge and withdraw NFTs via the withdrawTokens function.

• When an admin enables or disables an NFT collection.

In its current form, the function iterates through the entire list of NFT collections to check if the collection is already included. If the collection is not found in the list, it is then added to the array.

Because this function checks every collection one by one, the amount of gas needed depends on how many collections are already whitelisted. As the list of collections gets longer over time, the gas cost increases, eventually surpassing the block gas limit. This will make it impossible to execute the withdrawal and whitelisting functions, leading to a permanent Denial of Service (DoS).

Impact

If this vulnerability is not addressed, two critical issues will arise:

1. Users will be unable to bridge NFTs to L1: The withdrawal feature will become unusable, preventing users from transferring their NFTs to L1.

2. Admins will lose control over NFT collections: Admins will be unable to enable or disable NFT collections, severely limiting the protocol's functionality and governance.

Tools Used

Manual Review

Recommendations

To resolve this issue, the whitelisting process should be optimized by using a mapping instead of an array. This change will improve the time complexity from O(N) to O(1), ensuring that the gas cost remains constant regardless of the number of whitelisted NFT collections.