ArkProject: NFT Bridge

Summary

Failure of the transfer operation will result in the token being unable to be successfully transferred and entering custody status

Vulnerability Details

https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/starknet/src/bridge.cairo#L402

In the contract's escrow_deposit_tokens method, the erc721.transfer_from method is called to transfer tokens from the user account to the contract. However, if the transfer fails for any reason (such as unauthorized, insufficient balance, etc.), the current code does not check whether the transfer was successful, nor does it handle this failure. This oversight may result in the token failing to enter custody, but the contract still believes that the transfer has been completed, resulting in an inconsistent state.

• Not checking whether the transfer is successful: After the erc721.transfer_from method is called, the contract does not verify whether the transfer is successful.

• Not handling transfer failure: The current logic does not handle the case of transfer failure, which may result in token loss or inconsistent status.

Impact

• Lost Tokens: If tokens are not successfully transferred, users may think that the tokens are in custody, but in fact the tokens are still in their accounts, or in some cases may be completely lost.

• Contract State Inconsistency: The contract may think that the transfer is successful and update the internal state, which may cause the actual state of the tokens to be inconsistent with the contract record, leading to security vulnerabilities or incorrect contract behavior.

Tools Used

VSCode

Recommendations

• Check transfer results: After calling the erc721.transfer_from method, you should immediately check the return result or catch the exception to ensure that the transfer is successful.

• Handle failure conditions: If the transfer fails, you should roll back the entire transaction or take appropriate remedial measures to avoid inconsistent contract state.