ArkProject: NFT Bridge

Summary

The _whiteListCollection function in the smart contract contains an unbounded loop that iterates over the entire _collections array. This design could lead to excessive gas consumption or even function failure due to block gas limits, especially as the number of whitelisted collections grows.

Vulnerability Details

The vulnerable code is located in the _whiteListCollection function:

https://github.com/Cyfrin/2024-07-ark-project/blob/8f4f71d8b6487c316334a7e427f888cda01c8cff/apps/blockchain/ethereum/src/Bridge.sol#L340

The function iterates through the entire _collections array to check if the collection already exists before adding it. As the number of collections grows, this operation becomes increasingly expensive in terms of gas consumption.

Impact

1. Gas Limit Exceeded: For a large number of collections, the function may exceed the block gas limit, preventing any further additions to the whitelist.

2. Denial of Service: The contract could become unusable for whitelist management operations if the gas cost becomes prohibitively high.

3. Increased Costs: Even when successful, the operation becomes increasingly expensive for users as the list grows.

Tools Used

Manual code review

Recommendations

Use OpenZeppelin's EnumerableSet library: OpenZeppelin provides an efficient implementation for enumerable sets, which is ideal for this use case. Replace the current implementation with EnumerableSet.AddressSet. This will provide efficient add, remove, and enumeration operations.

PoC