ArkProject: NFT Bridge

Summary

The smart contract includes both receive and fallback functions to prevent the direct transfer of Ether to the contract.
However, due to the behavior of the selfdestruct function in Solidity, Ether can still be forcefully sent to the contract,
bypassing the protections offered by these functions.

Vulnerability Details

In Solidity, receive and fallback functions are used to handle Ether transfers sent directly to the contract without any
data or with data that doesn't match any function signature, respectively. By implementing these functions and reverting
any Ether transfers within them, a contract can effectively prevent users from directly sending Ether.

However, the selfdestruct function in Solidity allows a contract to send its remaining Ether balance to any address,
including contracts that have implemented protections against direct transfers. Since selfdestruct forcibly sends Ether
to the target address, it bypasses both the receive and fallback functions, leading to the unintended reception of Ether by the contract.

https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/UUPSProxied.sol#L42-L57

Impact

ether can be sent directly without using payable functions.

Recommendations