ArkProject: NFT Bridge
ArkProject
Submission Details
Severity: low
InvalidNFT withdraw is allowed by calling cancelRequest even when the bridge is not enabled
Updates
Lead Judging Commences
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:
invalid-cancel-when-bridge-disable
Technically, if you cancel a message, the token is not really bridged. If you can withdraw, it means that the token has already been bridged. Those two funtions do not have to be disable when the bridge is. Moreover nothing should prevent users to get back their NFT.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
High Medium
50,000 USDC
Low
5,500 USDC
Judges
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Community Judging
Submissions are being reviewed by the community.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.