ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lows

inh3l

L-01 - Contracts cannot be initialized if owner to set is different from deployer

Impact

After the contract has been deployed, the initialize function has to be called so as to setup the contract with its various paramteters. And looking at the function, we can see that ownership is first transferred to the owner and then, the setStarklaneL2Address and setStarklaneL2Selector functions are called.

function initialize(
bytes calldata data
)
public
onlyInit
{
(
address owner,
IStarknetMessaging starknetCoreAddress,
uint256 starklaneL2Address,
uint256 starklaneL2Selector
) = abi.decode(
data,
(address, IStarknetMessaging, uint256, uint256)
);
_enabled = false;
_starknetCoreAddress = starknetCoreAddress;
​
_transferOwnership(owner);
​
setStarklaneL2Address(starklaneL2Address);
setStarklaneL2Selector(starklaneL2Selector);
}

The setStarklaneL2Address and setStarklaneL2Selector functions however, are protected by the onlyOwner modifier which ensures that msg.sender is the owner.

function setStarklaneL2Address(
uint256 l2Address
)
public
onlyOwner
{
_starklaneL2Address = Cairo.snaddressWrap(l2Address);
}
​
function setStarklaneL2Selector(
uint256 l2Selector
)
public
onlyOwner
{
_starklaneL2Selector = Cairo.felt252Wrap(l2Selector);
}

And the contract is UUPSOwnableProxied/StarklaneState which are both Ownable contracts.

This means that upon deployment, ownership is immediately granted to the deployer.
So the only party that can call the initialize function is the deployer, but if he wishes to transfer ownership upon initialization, he will not be able to do so as the function will revert with a "caller is not owner" error

Recommendations

Call the _transferOwnership function after setting the starklane addresses not before.

Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.