60,000 USDC
Submission Details
Severity:
Use of deprecated `LegacyMap`
Summary
LegacyMaphas bee deprecated in favour of Map. However the feature is still used extensively in the codebase
Vulnerability Details
Find below its occurence in the bridge.cairocontract
File: bridge.cairo
60:
61:
62: struct Storage {
63: // Bridge address on L1 (to allow it to consume messages).
64: bridge_l1_address: EthAddress,
65: // The class to deploy for ERC721 tokens.
66: erc721_bridgeable_class: ClassHash,
67: // Mapping between L2<->L1 collections addresses.
68: @> l2_to_l1_addresses: LegacyMap::<ContractAddress, EthAddress>, // @audit change from LegacyMap to Map
69: // Mapping between L1<->L2 collections addresses.
70: @> l1_to_l2_addresses: LegacyMap::<EthAddress, ContractAddress>,
71: // Registry of escrowed token for collections.
72: // <(collection_l2_address, token_id), original_depositor_l2_address>
73: escrow: LegacyMap::<(ContractAddress, u256), ContractAddress>,
74:
75: // White list enabled flag
76: white_list_enabled: bool,
77:
78: // Registry of whitelisted collections
79: @> white_listed_list: LegacyMap::<ContractAddress, (bool, ContractAddress)>,
80: // white_listed_list: LegacyMap::<(ContractAddress, ContractAddress), bool>,
81: white_listed_head: ContractAddress,
82:
83: // Bridge enabled flag
84: enabled: bool,
85:
86:
87: ownable: OwnableComponent::Storage,
88: }
Impact
Use of deprecated items in the bridge contract
Tools Used
Manual review
Recommendations
It is recommended in the DOCS to use Mapinstead of LegacyMapas it has been depricated
Updates
Lead Judging Commences
n0kto 12 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.