Insufficient Gas Fee Validation in Cross-Chain NFT Bridge

ptisserand commented 3 days ago

From https://codehawks.cyfrin.io/c/2024-07-ark-project/s/14

The smart contract allows users to deposit NFTs into an escrow and initiate a cross-chain transfer to StarkNet (L2) with an arbitrary gas fee. The lack of a meaningful minimum gas fee requirement can result in NFTs being locked in the escrow contract if the L2 message is never processed due to insufficient gas.

ShantelPeters commented 2 days ago

Hello @ptisserand please i will love to take this up by tomorrow

SoarinSkySagar commented 2 days ago

I am applying to this issue via OnlyDust platform.

My background and how it can be leveraged

GM, I am Sagar Rana, a smart contract developer and full stack engineer. I have 3 years of experience building robust full stack applications and over a year of writing smart contracts. You can see my projects and contributions to some major repos on my GitHub profile. The tech stack I use mainly includes Solidity, Rust, JavaScript and Typescript. I am also contributing to the Starknet and Rust ecosystems and building on Cairo language. I am interested in contributing to projects like this to learn more about these technologies and help make these projects better. Please assign me as I would be really glad to be a contributor in this project! :)

How I plan on tackling this issue

Hi @ptisserand, I went through the codehawks article and I am pretty confident I can resolve this issue.

Implement a higher minimum gas fee

uint256 public constant MIN_GAS_FEE = 1e9; // Example: 1 gwei minimum gas fee

Implement check to ensure minimum gas fee is maintained

require(msg.value < MIN_GAS_FEE, "Insuffiecient gas fee");

Add a Reclaim Mechanism: To allow users to reclaim their NFTs if the L2 transaction fails or isn't processed after a certain period, we'll need to track deposits and implement a reclaimTokens function. This function will allow users to reclaim their NFTs after a set timeout period if the L2 message wasn't processed.

Tasks:

[ ] Implement minimum gas fee
[ ] Implement Reclaim function

ETA: 1 Day

aji70 commented 2 days ago

I am applying to this issue via OnlyDust platform.

My background and how it can be leveraged

i'm a solidity and cairo smart contract developer with over 2 years experience and believe i have the skill set for the task and i am also very good with smart contract testing

DanielEmmanuel1 commented 2 days ago

I am applying to this issue via OnlyDust platform.

My background and how it can be leveraged

Good morning once again ArkProject My name is Deon and I'd like to apply formally for the task presented. I am a Web and blockchain engineer with a passion for building user interfaces and Dapps that deliver meaningful experiences. With a background in Computer Science (BSc) and hands-on experience. If given the chance to contribute this will be my second official contribution via onlydust and I'm confident in my ability to deliver on the feature you're looking for.

How I plan on tackling this issue

Understand the Deposit and Escrow Logic:
I will review the smart contract’s logic, focusing on how gas fees are handled when users deposit NFTs for cross-chain transfer. This includes understanding how gas fees are passed to the L2 network and identifying the conditions where transactions could fail due to insufficient fees.
Implement a Minimum Gas Fee Requirement:
I will introduce a minimum gas fee requirement within the depositTokens function. This will prevent users from initiating transfers with extremely low gas fees that are unlikely to be picked up by the L2 network. The minimum threshold will be set at a level that ensures the L2 message has enough gas to be processed.
Add a Reclaim Mechanism for Stuck NFTs:
I will implement a function that allows users to reclaim their NFTs if the L2 message has not been processed within a certain time period. This mechanism ensures that users can recover their assets if the cross-chain message is not executed due to insufficient gas fees.
Write Unit Tests to Validate Gas Fee Checks and Reclaim Logic:
I will write unit tests to ensure the new minimum gas fee validation works as expected. Tests will cover both successful transfers with adequate fees and rejections due to insufficient fees. Additionally, tests will be written for the reclaim mechanism to verify that users can retrieve their NFTs if the L2 message fails to process.
Finally I will ensure all edge cases are covered, including scenarios where fees are just above or below the threshold, and that the reclaim mechanism is reliable in cases where L2 transactions remain pending.

onlydustapp[bot] commented 2 days ago

The maintainer ptisserand has assigned DanielEmmanuel1 to this issue via OnlyDust Platform. Good luck!

ArkProjectNFTs / bridge