ArkProject: NFT Bridge

Vulnerability Details

in the '_setL1L2AddressMapping'

The function allows setting a new mapping between L1 and L2 addresses if either the L1 or L2 address is not already mapped (or if 'force' is true). However, it doesn't check if the other address in the pair is already mapped to a different address.

For example, if L1 address A is already mapped to L2 address B, and we call this function with L1 address A and a new L2 address C (assuming C is not mapped), it will create a new mapping without removing the existing one. This could lead to inconsistent state where:

1. L1 address A is mapped to both L2 addresses B and C

2. L2 address B still thinks it's mapped to L1 address A

This could cause issues with token bridging

Impact

• Admin calls setL1L2CollectionMapping(L1_A, L2_B)

• Later, admin calls setL1L2CollectionMapping(L1_A, L2_C) (assuming L2_C is not mapped)

• Result: L1_A is now mapped to both L2_B and L2_C, but L2_B still thinks it's mapped to L1_A

• This inconsistency could lead to:

  • Tokens being minted on L2_C when they should go to L2_B

  • Potential double-spending if both L2_B and L2_C can claim ownership of the same L1 tokens

  • Confusion in the deposit/withdraw process, potentially leading to locked or lost tokens

Tools Used

Manual review

Recommendations

To fix this, the function should check both addresses and only allow the mapping if both are unmapped (unless 'force' is true, in which case it should remove any existing mappings