Summary

`If ​​multiple transactions pass in the same parameters, it may cause request hash collision or replay attack

Vulnerability Details

https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Bridge.sol#L110

The depositTokens method uses the external input parameters salt, collectionL1, ownerL2, and ids to generate a request hash (requestHash). Because these parameters are user-controllable, if multiple users or the same user repeatedly call depositTokens without changing these parameters, the same request hash may be generated. Although the code mentions that requestHash needs to be stored to prevent replay attacks, the current code does not implement this logic.

• Request hash collision: When salt, collectionL1, ownerL2, and ids are the same, requestHash will be the same, which may cause duplicate requests to be processed.

• Replay attack: An attacker can intercept a transaction and send it again, performing repeated operations with the same request hash. If the contract does not store and verify the hash value, the attacker may be able to reuse the same request to withdraw or deposit tokens.

Impact

• Duplicate operations: If the same request is processed multiple times, it may lead to repeated token transfers or repeated transaction records, which in turn affects the normal operation of the contract.

• Replay attack: An attacker may use the same request to repeatedly initiate token transfer or withdrawal operations, resulting in illegal transfer or loss of assets.

Tools Used

VSCode

Recommendations

• Store and verify request hash: After generating the request hash, it should be stored in the contract and checked when processing a new request to see if the same request has been processed to avoid duplicate operations.

• Introduce randomness: Encourage users to use a different salt each time they call the depositTokens method to avoid generating the same request hash.

• Implement timestamp verification: Consider incorporating timestamps into hash calculations or adding expiration times to requests to prevent replay attacks.