CodeHawks
Competitive Audits
First Flights
Judging
Leaderboard
Docs
Toggle theme
Connect Wallet
All Contests
ArkProject: NFT Bridge
Submissions
ArkProject: NFT Bridge
ArkProject
ArkProject: NFT Bridge
ArkProject
NFT
Bridge
60,000
USDC
Public
60,000
USDC
Jul 31st, 2024 → Aug 28th, 2024
View repo
955 / 955
Submissions
Severity
Tags
#1
Missing Storage Gap in Starklane Contract
Medium
#2
Uninvoked _disableInitializers Function in Starklane Contract
High
#3
Missing Call to _disableInitializers() UUPSOwnableProxied contract
High
#4
Use of `CREATE` opcode is suspicious of reorg attack
Medium
#5
Potential front-running vulnerability in `initialize` function
Low
#6
Depositing into escrow will not work with ERC1155 tokens
Medium
#7
Initializer function can be front run
Low
#8
The `escrow` storage mapping is not reset to `0` once a token is withdrawn from the bridge on starknet
Low
#9
`UUPSOwnableProxied` is missing `initialize()` function
Medium
#10
Initialization Function Can Be Called Multiple Times in Bridge.sol
Low
#11
Conditional Storage Checks Are Not Consistent Protocol.sol
Low
#12
Unimplemented function `erc1155Metadata`
Medium
#13
Validation Missing for Zero Address in `setStarklaneL2Address` Function in State.sol
Low
#14
Insufficient Gas Fee Validation in Cross-Chain NFT Bridge
High
#15
Corruptible Upgradability Pattern
Medium
#16
Lack of minimun bridge fee check
Low
#17
`Bridge::depositTokens()` lacks the evaluation and check of `msg.value`, which may result in the loss of `ETH` and the `NFT` being locked in the contract.
Medium
#18
NFTs will be locked if bridge to contracts without `onERC721Received` implementation
High
#19
Not be able to safe transfer ERC1155 tokens to bridge
Low
#20
Unprotected `initialize()`
Low
#21
Missing Check for Minimum Token IDs in `depositTokens` Function
Medium
#22
Use unchecked {++i} and don't declare i=0
Low
#23
Anyone can cancel any request in bridge.sol
Medium
#24
Unauthorized Token Withdrawal Initiation Vulnerability
High
#25
Bridged non-escrowed NFT does not have URIs and will not display properly
Medium
#26
200
Low
#27
Critical Loss of Transaction Traceability and Cancellation Capability
High
#28
Create methods are suspicious of the reorg attack
Medium
#29
User tokens can get stuck in escrow
Medium
#30
Lack of Uniqueness in Deployed Proxies
Medium
Previous
1
2
3
...
More pages
32
Next
Support
FAQs
Can’t find an answer? Join our Discord or follow us on Twitter.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
What is community judging?
How do I get rewarded?
What is a First Flight?
Give us feedback!
