Summary

Permanent locking up of tokens and DOS of bridge as L1 bridge does not call StarknetMessaging.sol directly

Vulnerability Details

Messages from starknet are manually consumed on L1 and the tokens are sent to owner_L1 which was computed in the request gotten from the L2(starknet). The issue arises in the way the message is consumed which follows;

withdrawTokens() in the L1 bridge tries to consume the message from starknet and calls _consumeMessageStarknet() an internal function in Messaging.sol which then calls StarknetMessaging.consumeMessageFromL2()

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L173-L175

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Messaging.sol#L99-L110

But as the cairo book states in https://book.cairo-lang.org/ch16-04-L1-L2-messaging.html#sending-messages-from-starknet-to-ethereum check the note at the end of this section it states that the entity calling StarknetMessaging.consumeMessageFromL2() must be the to_address that was passed in the argument on starknet which in this case is the L1 bridge and not Messaging.sol https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L295-L298

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/bridge.cairo#L63-L64 so when StarknetMessaging.consumeMessageFromL2() is invoked by Messaging.sol and tries to consume the message it will always revert as msg.sender is used as an argument for hashing https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/lib/starknet/StarknetMessaging.sol#L153-L158 hence agreeing with the warning in the official cairo book hence message can never be consumed and tokens are lost permanently and bridge is DOS'd permanently.

Impact

Tokens are lost permanently and bridge is DOS'd permanently.

Tools Used

Manual Review

Recommendations

L1 bridge should call StarknetMessaging.consumeMessageFromL2() directly.