ArkProject: NFT Bridge

Summary

The NFT bridge has a whitelisting mechanism where collections can be whitelisted and allowed to use the protocol if the whitelist flag is enabled within the protocol. However, this design does not factor in cases where a previously whitelisted collection is removed from the whitelist because it was a malicious collection. Malicious collections should not be allowed back to the bridge.

Consider the following scenario:

1. Collection A is whitelisted to be used in the NFT bridge and the whitelist flag is set to True only permitting allowed collections to use the bridge.

2. Collection A is determined to be malicious and now it is removed from the whitelist.

3. The protocol decides to set the whitelistEnabled flag to false permitting all kinds of collections to use the bridge.

4. At this point, the malicious bridge is allowed back to the bridge.

Vulnerability Details

The _isWhitelistedfunction is implemented as follows:

Solidity applies the short-circuiting rules as seen here https://docs.soliditylang.org/en/latest/types.html meaning once !``whiteListedEnabled_evaluates to false then the __whiteList[collection]`check would not evaluated.

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L333-L338

Impact

Malicious collections that were previously removed from the whitelist can still use the bridge.

Tools Used

Recommendations

Consider removing the !``whiteListEnabled_from the _isWhiteListedfunction check.