User with no owned tokens can send empty deposit requests from L2
Details
deposit_tokens in L2 bridge contract takes in list of token_ids to be bridged. But it doesn't revert if the list is empty. It just creates a request with any given whitelisted collection and empty token_ids. As the token_ids list is empty nothing will fail and the deposit request will be successful.
Impact
Any user with no owned tokens for a whitelisted collection can create any amount of deposit requests with empty token_ids
Recommendations
Revert if token ids list length is zero in escrow_deposit_tokens
Lead Judging Commences
invalid-empty-tokenIds-starknet-side
No real impact. Attacker will have to pay the deployment of the new contract even with 0 token, and it won’t have any interest do to that since he won’t take the control of the contract.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.