ArkProject: NFT Bridge

Summary

The token_ids array is not fully validated, which may lead to batch transactions with empty arrays

Vulnerability Details

https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/starknet/src/bridge.cairo#L402

In the deposit_tokens method, if token_ids is passed an empty array, the code will continue to execute and trigger the DepositRequestInitiated event, even if no actual tokens are in custody. Although a single empty array transaction has little direct impact on the system, a malicious user can send empty array transactions in batches to continuously trigger events, causing increased load on the blockchain network.

• Batch empty array transactions: Due to the lack of checks on whether the token_ids array is empty, malicious users can send empty array requests in batches and repeatedly trigger contract events.

• Event Abuse: Each empty array request triggers the DepositRequestInitiated event, although there is no actual token transfer. This may cause the on-chain event log to be polluted and increase the network burden.

• Resource Waste: Batch empty array transactions will occupy on-chain resources, increase processing time and cost, and may affect the execution of other valid transactions.

Impact

• Increased network load: Malicious users can increase network load and affect the overall performance of the blockchain by sending a large number of empty array requests.

• Event log pollution: Triggering a large number of invalid events will make the on-chain logs messy and increase the difficulty of auditing and monitoring.

• Resource consumption: Batch empty array transactions will waste on-chain computing and storage resources, which may lead to unnecessary on-chain fees.

Tools Used

VSCode

Recommendations

• Add empty array check: In the deposit_tokens method, add a check to see if token_ids is empty. If the array is empty, stop the operation immediately and return an error message.

• Limit batch transactions: Add restrictions on batch transactions in the contract, such as limiting the transaction frequency of each account or setting a maximum transaction amount to reduce the risk of abuse.

• Optimize event triggering logic: Before triggering an event, ensure that actual tokens are in custody. If no tokens are transferred, the event should not be triggered.