ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Field Validation in `bridge.cairo::withdraw_auto_from_l1` Function to ensure they adhere to expected formats and constraints

bhanujangid

Description:

The bridge.cairo::withdraw_auto_from_l1 function needs to validate all fields in the request to ensure they adhere to expected formats and constraints. This validation is crucial for ensuring data integrity and correctness during token transfers from Layer 1 to Layer 2.

Impact:

Failure to validate input fields could result in several issues, including:

  • Data Integrity Issues: Malformed or incorrect data could lead to the incorrect handling of tokens during the transfer process,
    potentially causing token losses or incorrect token states on Layer 2.

  • Security Risks: Unvalidated inputs might open up vectors for attacks, such as passing in invalid addresses or token IDs that
    could lead to unexpected contract behavior.

  • Operational Errors: Incorrect data processing could cause the function to fail or behave unpredictably, resulting in operational
    issues and potential downtime.

Recommended Mitigation:

The following validation checks have been added to the bridge.cairo::withdraw_auto_from_l1 function:

​
// Field validation
+ assert(req.collection_l2 != 0, 'Invalid L2 collection address');
+ assert(req.owner_l1 != 0, 'Invalid L1 owner address');
+ assert(req.owner_l2 != 0, 'Invalid L2 owner address');
​
// Validate token IDs
+ let ids_len = req.ids.len();
+ assert(ids_len > 0, 'Token IDs list cannot be empty');
+ for i in 0..ids_len {
+ let token_id = *req.ids[i];
+ assert(token_id > 0, 'Invalid token ID');
+ }
​
// Validate URIs (if any)
+ if req.uris.len() > 0 {
+ assert(req.uris.len() == req.ids.len(), 'Mismatch between URIs and IDs');
+ for uri in req.uris.iter() {
+ assert(uri.len() > 0, 'URI cannot be empty');
+ }
+ }
​
// Validate hash (e.g., length check for a SHA256 hash)
+ assert(req.hash.len() == 32, 'Invalid hash length');
​
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.