ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Cancellation of L1 to L2 Messages Not Possible Without Owner Intervention

web3pirate

Relevant GitHub Links

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L223

Summary

The process to cancel a transfer from Layer 1 (L1) to Layer 2 (L2) requires initiating the cancellation through the startL1ToL2MessageCancellation function of the Starknet Core Contract, which is encapsulated within the startRequestCancellation function. However, due to the latter being restricted to the owner's access, users cannot independently initiate cancellations, leading to a highly centralized system.

Vulnerability Details

The procedure for cancelling an L1 to L2 message, as outlined in the Starknet documentation, involves:

  1. The user that initiated the L1→L2 message calls the startL1ToL2MessageCancellation function in the Starknet Core Contract.

  2. The user waits five days until she can finalize the cancellation.

  3. The user calls the cancelL1ToL2Message function.

The existing setup prevents the requester of an NFT transfer from performing step 1, as the startRequestCancellation function, crucial for initiating the cancellation, is exclusively accessible by the owner.

Impact

Transferring parties are unable to cancel their transfer requests.

Tools Used

Manual

Recommendations

Modify the startRequestCancellation function by removing the onlyOwner restriction and incorporating a verification step to confirm the original requester is initiating the cancellation. Here's the revised function:

function startRequestCancellation(
uint256[] memory payload,
uint256 nonce
-) external onlyOwner {
+) external {
+ Request memory req = Protocol.requestDeserialize(payload, 0);
+ require(req.ownerL1 == msg.sender, "Unauthorized");
IStarknetMessaging(_starknetCoreAddress).startL1ToL2MessageCancellation(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
​
- Request memory req = Protocol.requestDeserialize(payload, 0);
emit CancelRequestStarted(req.hash, block.timestamp);
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.