ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Required parameter types is `calldata` but `memory` is being used.

unRekt

Summary

Certain functions of starknet require parameter of the type calldata but the parameters passed is of type memory

Vulnerability Details

startRequestCancellation function

cancelRequest function

Starklane::startRequestCancellation calls startL1ToL2MessageCancellation here

function startRequestCancellation(
@> uint256[] memory payload,
uint256 nonce
) external onlyOwner {
@> IStarknetMessaging(_starknetCoreAddress).startL1ToL2MessageCancellation(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
Request memory req = Protocol.requestDeserialize(payload, 0);
emit CancelRequestStarted(req.hash, block.timestamp);
}

The definition of startL1ToL2MessageCancellation :

function startL1ToL2MessageCancellation(
uint256 toAddress,
uint256 selector,
@> uint256[] calldata payload,
uint256 nonce
) external returns (bytes32);

Above is the definition of startL1ToL2MessageCancellation function of Starknet which takes payload as type calldata but the type passed by startRequestCancellation is memory.

Starklane::cancelRequest calls cancelL1ToL2Message here

function cancelRequest(
@> uint256[] memory payload,
uint256 nonce
) external {
@> IStarknetMessaging(_starknetCoreAddress).cancelL1ToL2Message(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
Request memory req = Protocol.requestDeserialize(payload, 0);
_cancelRequest(req);
emit CancelRequestCompleted(req.hash, block.timestamp);
}

The definition of cancelL1ToL2Message :

function startL1ToL2MessageCancellation(
uint256 toAddress,
uint256 selector,
@> uint256[] calldata payload,
uint256 nonce
) external returns (bytes32);

Above is the definition of cancelL1ToL2Message function of Starknet which takes payload as type calldata but the type passed by cancelRequest is memory.

Impact

Mismatch of data type of parameters

Tools Used

Manual review

Recommendations

Use the correct data type i.e. calldata for payload.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.