ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Starknet request cancellation has onlyOwner

SBSecurity

Summary

startRequestCancellation has an onlyOwner modifier and will lead to prolonged periods of blocked NFTs in case bridging to Starknet fails.

Vulnerability Details

The issue is marked as fixed in the private audit (M-04) but it still persists:

function startRequestCancellation(
uint256[] memory payload,
uint256 nonce
) external onlyOwner {
IStarknetMessaging(_starknetCoreAddress).startL1ToL2MessageCancellation(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
Request memory req = Protocol.requestDeserialize(payload, 0);
emit CancelRequestStarted(req.hash, block.timestamp);
}

Disabling users from unblocking their NFTs can cause various issues, especially if the NFT is rented for some time. Having the onlyOwner means that no one except the admin can initiate cancellation and that’s why tokens will be blocked for extended periods of time, even more when there are a lot of requests from the users to the admin to start their cancelations.

Impact

Users can’t start their request cancelations and should rely on the admin to call startRequestCancellation in a timely manner.

Tools Used

Manual Review

Recommendations

function startRequestCancellation(
uint256[] memory payload,
uint256 nonce
- ) external onlyOwner {
+ ) external {
IStarknetMessaging(_starknetCoreAddress).startL1ToL2MessageCancellation(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload,
nonce
);
Request memory req = Protocol.requestDeserialize(payload, 0);
emit CancelRequestStarted(req.hash, block.timestamp);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.