ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Withdrawals do not check for whitelists

josephdara

Summary

The Starklane contract includes a vulnerability where the withdrawTokens function does not check whether the token collection is whitelisted before allowing withdrawals. This oversight can allow unauthorized collections to be withdrawn.

Vulnerability Details

The withdrawTokens function is responsible for handling the withdrawal of tokens from the L2 side of the bridge. However, the function does not check if the collection involved in the withdrawal is part of the whitelist or if whitelist is enabled. This omission is critical, as it allows any token collection, including those that have not been explicitly approved, to be withdrawn through the bridge when whitelist is active.

Impact

This issue whitelists new tokens that weren't previously whitelisted. It also allows for withdrawals of unwhitelisted tokens.

function withdrawTokens(
uint256[] calldata request
) external payable returns (address) {
if (!_enabled) {
revert BridgeNotEnabledError();
}
​
// Header is always the first uint256 of the serialized request.
uint256 header = request[0];
​
// Any error or permission fail in the message consumption will cause a revert.
// After message being consumed, it is considered legit and tokens can be withdrawn.
if (Protocol.canUseWithdrawAuto(header)) {
// 2024-03-19: disabled autoWithdraw after audit report
// _consumeMessageAutoWithdraw(_starklaneL2Address, request);
revert NotSupportedYetError();
} else {
_consumeMessageStarknet(
_starknetCoreAddress,
_starklaneL2Address,
request
);
}
​
Request memory req = Protocol.requestDeserialize(request, 0);
​
address collectionL1 = _verifyRequestAddresses(
req.collectionL1,
req.collectionL2
);

Tools Used

manual review

Recommendations

While whitelist is enabled, check if the collectionL1 is whitelisted, or whitelist collectionL2 address as uint256

Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.