ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Unbounded loop in `_whiteListCollection` will make the bridge unusable

jokrsec

Summary

Pending NFTs might get locked and bridge will be unsuable after a point due to use of unbounded loops

Vulnerability Details

When the NFTs are bridged from L2 -> L1, the withdrawTokens function can be called by user to withdraw bridged NFT. But if it is the first token of a NFT collection, then correponding bridgable collection would be deployed in L1. Along with that collection address of deployed contract will be whitelisted

collectionL1 = _deployERC721Bridgeable(
req.name,
req.symbol,
req.collectionL2,
req.hash
);
// update whitelist if needed
_whiteListCollection(collectionL1, true);
​

But the _whiteListCollection function loops on all of the collections array to add a whitelist. This function would gradually consume more gas due to increasing array length. At some point the gas required will be more than the gas block limit causing the whole transaction to revert.

Impact

  1. pending NFTs bridged from L2 will get locked forever. And also the bridge contract would be unusable further

  2. At some point no more collections can be whitelisted

Tools Used

Manual review

Recommendations

There has to be a way to remove the disabled tokens. Or unbounded loops need to be removed

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-collections-always-withelisted-on-both-chain-withdraw-impossible-collections-array-will-be-OOG

Likelyhood: High, once the whitelist option is disabled, collections will grow. Impact: High, withdraw won’t be possible because of Out-Of-Gas.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.