ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No access control in `Starklane::initialize` function

tdey

Summary

No access control present in the initialize function, in case the protocol is deployed on mainnet and admin forgets to call the function, it can be called by anyone and they would become the owner. Which is not desirable.

Vulnerability Details

The initialize function :

function initialize(
bytes calldata data
)
public
onlyInit
{
(
address owner,
IStarknetMessaging starknetCoreAddress,
uint256 starklaneL2Address,
uint256 starklaneL2Selector
) = abi.decode(
data,
(address, IStarknetMessaging, uint256, uint256)
);
_enabled = false;
_starknetCoreAddress = starknetCoreAddress;
​
_transferOwnership(owner);
​
setStarklaneL2Address(starklaneL2Address);
setStarklaneL2Selector(starklaneL2Selector);
}

link to code

The function is marked with onlyInit modifier which ensures that the function can only be called once.
But it lacks access control modifier, like onlyAdmin.

In case the protocol is deployed and someone calls the function before admin then they can become the owner and gain admin access. As this line _transferOwnership(owner); in the function transfers ownership to the owner

Impact

Likelihood is low as this can only occur in case of a mistake
Impact high as someone else can gain admin rights

Hence, keeping the impact as low as this is a very niched down situation.

Tools Used

Manual review

Recommendations

Use access control modifiers

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid-bridge-initialize-frontrun

If frontrun at the first deployment, protocol will deploy again, no real impact: informational. Moreover it is already deployed and initialize on mainnet. For the upgrades, `initialize` can/will change for the next update since the owner is already set. A lot of protocol make that change. That’s why I consider it like a future feature and it is out of scope.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.