cancelRequest():: Anyone without authorization can cancel the request.
Summary
No check to prevent unauthorized person from cancelling request.
Vulnerability Details
Inside Bridge.sol, In function cancelRequest() there is no access control modifier to ensure only authorized address can cancel the request.
Impact
Request can be canceled by anyone not having authorization.
Tools Used
Manual
Recommendations
Add onlyOwner modifier in function cancelRequest().
Lead Judging Commences
invalid-cancel-callable-by-anyone
The process to cancel a message is detailed here: https://docs.starknet.io/architecture-and-concepts/network-architecture/messaging-mechanism/#l2-l1_message_cancellation Since `startRequestCancellation` has the `onlyOwner`, only the owner can begin that process.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.