ArkProject: NFT Bridge

Summary

The initialize function in the bridge contract can be called each time the contract undergoes an upgrade. This flaw allows an attacker to invoke the initialize function immediately after the bridge contract is upgraded, thereby gaining ownership and control over the contract.

Vulnerability Details

The bridge smart contract inherits from the UUPSProxied contract, which includes the onlyInit modifier. This modifier is intended to ensure that the initialize function is only called once per contract lifecycle.

Below is the code snippet demonstrating how the onlyInit modifier is implemented:

Additionally, here is the code for the initialize function:

The initialize function is designed to set up the initial state of the bridge contract and should only be executed once during the contract’s lifetime. However, the current implementation of the onlyInit modifier permits the initialize function to be called again whenever the implementation address changes.

This vulnerability enables an attacker to execute the initialize function right after the bridge contract is upgraded by the admin using the upgradeTo or upgradeToAndCall functions. As a result, the attacker can gain ownership of the bridge contract.

Impact

If exploited, this vulnerability allows an attacker to gain ownership and full control over the bridge contract, which is a highly critical security risk.

Tools Used

Manual Review

Recommendations

The onlyInit modifier should be revised to ensure that the initialize function can only be called once throughout the entire lifespan of the smart contract.