ArkProject: NFT Bridge

Summary:

If someone manually transfers an ERC721 token to the contract, it can be claimed by anyone since the contract does not verify the original depositor.

Vulnerability Details:

Deposit Function:

The _depositIntoEscrow function records the depositor’s address in the _escrow mapping.
However, if a token is manually transferred to the contract without using this function, the _escrow mapping is not updated.
Withdraw Function:

The _withdrawFromEscrow function checks if the token is in escrow but does not verify the original depositor.
This means anyone could potentially call the withdraw function and claim ownership of manually transferred tokens.

Example Scenario:
User A manually transfers an ERC721 token to the contract.
The _escrow mapping is not updated.
User B calls the _withdrawFromEscrow function and successfully withdraws the token, even though they did not originally deposit it.

Impact:

Since the contract does not verify the original depositor when withdrawing tokens, anyone can claim ownership of a token that was manually transferred to the contract. This effectively allows malicious actors to steal tokens that do not belong to them.

Tools Used:

Manual review

Recommendations:

Ensure that only tokens deposited through the _depositIntoEscrow function can be withdrawn.
Implement checks to verify the original depositor before allowing withdrawals.