ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Refund Mechanism for Canceled Messages Leading to Potential User Fund Loss.

ali9896546

Summary

In the current implementation, when a message is canceled, the system does not refund the user the ETH that was initially spent.
This can lead to a loss of funds for the user, creating a potential financial risk within the system.

Vulnerability Details

When a user cancels a message, the intended logic should ideally refund the ETH spent during the transaction. However,
the existing codebase lacks this refund mechanism. As a result, users who cancel their messages lose the ETH they spent,
which is neither returned to their account nor utilized in any other manner.

function cancelRequest(uint256[] memory payload, uint256 nonce) external {
IStarknetMessaging(_starknetCoreAddress).cancelL1ToL2Message(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
Request memory req = Protocol.requestDeserialize(payload, 0);
_cancelRequest(req);
emit CancelRequestCompleted(req.hash, block.timestamp);
}
​
function _cancelRequest(Request memory req) internal {
uint256 header = felt252.unwrap(req.header);
CollectionType ctype = Protocol.collectionTypeFromHeader(header);
address collectionL1 = req.collectionL1;
for(uint256 i = 0; i < req.tokenIds.length; i++) {
uint256 id = req.tokenIds[i];
_withdrawFromEscrow(ctype, collectionL1, req.ownerL1, id);
}
}

Impact

Eth are lost and not refunded if a bug accor in L2 contracts.

Recommendations

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.