ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

cancelRequest does not handle paused state

josephdara

Summary

The Starklane contract contains a vulnerability where the cancelRequest function does not respect the paused state of the bridge. This allows request cancellations to proceed even when the bridge is paused, which is an unintended behaviour within the contract state

Vulnerability Details

The cancelRequest function is designed to cancel pending requests by interacting with the Starknet messaging system. However, the function does not check whether the bridge is enabled before performing the cancellation. This oversight can allow request cancellations to occur even when the bridge is paused, which contradicts the expected behavior of a paused system.

function cancelRequest(
uint256[] memory payload,
uint256 nonce
) external {
IStarknetMessaging(_starknetCoreAddress).cancelL1ToL2Message(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
Request memory req = Protocol.requestDeserialize(payload, 0);
_cancelRequest(req);
emit CancelRequestCompleted(req.hash, block.timestamp);
}
​

Impact

The impact of this vulnerability is significant. Allowing actions to proceed on a paused bridge undermines the purpose of the pause functionality, which is typically used to halt operations during emergencies or when critical issues are detected.

Tools Used

Manual code review

Recommendations

Modify the cancelRequest function to include a check that ensures the bridge is enabled before allowing any cancellations to proceed.
require(_enabled, "Bridge is paused");

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

invalid-cancel-when-bridge-disable

Technically, if you cancel a message, the token is not really bridged. If you can withdraw, it means that the token has already been bridged. Those two funtions do not have to be disable when the bridge is. Moreover nothing should prevent users to get back their NFT.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.