ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Logic for Withdrawing Accumulated ETH Gas Fees from the Bridge Contract

bladesec

Summary

The bridge contract currently charges gas fees for each message sent through it. However, there is a missing mechanism to withdraw the ETH collected from these gas fees, leaving the accumulated ETH locked inside the contract.

Vulnerability Details

The function sendMessageToL2 in the bridge contract is responsible for sending messages to Starknet and charging ETH as gas fees for this service. Below is the relevant code snippet:

function sendMessageToL2(
uint256 toAddress,
uint256 selector,
uint256[] calldata payload
) external payable override returns (bytes32, uint256) {
require(msg.value > 0, "L1_MSG_FEE_MUST_BE_GREATER_THAN_0");
require(msg.value <= getMaxL1MsgFee(), "MAX_L1_MSG_FEE_EXCEEDED");
uint256 nonce = l1ToL2MessageNonce();
NamedStorage.setUintValue(L1L2_MESSAGE_NONCE_TAG, nonce + 1);
emit LogMessageToL2(msg.sender, toAddress, selector, payload, nonce, msg.value);
bytes32 msgHash = getL1ToL2MsgHash(toAddress, selector, payload, nonce);
// Note that the inclusion of the unique nonce in the message hash implies that
// l1ToL2Messages()[msgHash] was not accessed before.
l1ToL2Messages()[msgHash] = msg.value + 1;
return (msgHash, nonce);
}

In this function, the contract charges a gas fee in ETH for each message sent to Starknet. The fee is accumulated within the bridge contract. However, there is currently no function or method in the contract that allows the owner (or any authorized entity) to withdraw the accumulated ETH.

This means that while ETH is being collected as gas fees, it remains inaccessible and locked inside the contract because there is no implemented logic to withdraw it.

Impact

If this issue is not addressed, the protocol team will lose access to the gas fees that are accumulating in the bridge contract. Over time, this could result in a significant loss of funds that could have been used for other purposes, such as protocol maintenance or further development.

Tools Used

Manual Review

Recommendations

To resolve this issue, it is recommended to add a method in the contract that allows the owner (or another authorized entity) to withdraw the accumulated ETH.

Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.