ArkProject: NFT Bridge

Summary

There is no access modifier on cancelRequest as any one call this function.

Vulnerability Details

function cancelRequest(
uint256[] memory payload,
uint256 nonce
) external {

IStarknetMessaging(_starknetCoreAddress).cancelL1ToL2Message(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
Request memory req = Protocol.requestDeserialize(payload, 0);
_cancelRequest(req);
emit CancelRequestCompleted(req.hash, block.timestamp);

}

Impact

Any one can call cancelRequest function and cancelrequest.

Tools Used

Recommendations

use onlyowner modifier.