ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`erc721_bridgeable.cairo::mint_range` could fall into an infinite loop

simon0417

Relevant Github Link

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/starknet/src/token/erc721_bridgeable.cairo#L141

Summary

The erc721_bridgeable.cairo::mint_range function is designed to mint multiple ERC721 tokens with consecutive token IDs. However, the loop within the function will not break if the start parameter is greater than the end parameter.

Vulnerability Details

fn mint_range(ref self: ContractState, to: ContractAddress, start: u256, end: u256) {
let mut token_id = start;
loop {
if token_id == end { //if start > end, it will never break
break ();
}
self.mint(to, token_id);
token_id += 1_u256;
}
}
​

The loop is designed to break only when token_id is equal to end. If incorrect arguments are provided where start is greater than end, the loop will never break because the break condition will never be met.

Impact

Likelihood: Low
This issue is currently not in use. Additionally, even if it were to be used, the arguments to call the function would likely be controlled by an admin.

Impact: High
If the function is called with the wrong arguments, it could result in extra bridged tokens being sent to an incorrect address. As a consequence, the users who own the corresponding native tokens will not be able to bridge their tokens, as the bridged tokens will have already been minted and sent to another address.

Tools Used

Manual Review

Recommendations

​
- if token_id == end {
+ if token_id >= end {
​
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.