Cross-Chain Transfer Risks may lead to token loss in the smart contracts

[0xM3R]

Vulnerability Details

The transferCrossChain function burns tokens before confirming their successful minting on the destination chain. This approach risks permanent token loss if the cross-chain operation fails.

Analysis

The vulnerable implementation

standard-contracts/contracts/nft/contracts/evm/UniversalNFT.sol

Line 71 in a08166a

bytes memory message = abi.encode(

:

_burn(tokenId);
bytes memory message = abi.encode(destination, receiver, tokenId, uri, msg.sender);
gateway.depositAndCall{value: msg.value}(universal, message, RevertOptions(...));

• Tokens are burned unconditionally before confirmation.
• If the cross-chain transfer fails, the token cannot be recovered without external intervention.

How It Can Be Harmful

• Token Loss: Users permanently lose tokens in case of cross-chain failures.
• Operational Risks: Dependency on external gateway contracts introduces single points of failure.

PoC Code

Attempt a cross-chain transfer to an invalid destination address and observe the behavior:

transferCrossChain(tokenId, invalidReceiver, invalidDestination);

• Tokens will be burned, but minting on the destination chain will not occur.

How to Mitigate the Issue

1. Implement a Locking Mechanism:
   Instead of burning tokens immediately, lock them until the cross-chain transfer is confirmed.

   lockedTokens[tokenId] = true;

2. Atomic Operations:
   Ensure that burning occurs only after successful confirmation of minting on the destination chain.

References

• SWC-113: DoS with Failed Call: Discusses the risks of relying on unhandled external calls.
• SWC Registry - SWC-113
• Nomad Bridge Hack Analysis: A real-world example of risks involved in cross-chain token management.
  • Nomad Bridge Hack
• CVE-2022-35916: Describes vulnerabilities caused by incorrect assumptions about cross-chain calls.
  • CVE Details - CVE-2022-35916

[0xM3R]

The same flawed logic has been implemented in the UniversalToken.sol as well.

standard-contracts/contracts/token/contracts/evm/UniversalToken.sol

Line 47 in a08166a

_burn(msg.sender, amount);

The vulnerable implementation:

_burn(msg.sender, amount);

bytes memory message = abi.encode(
    destination,
    receiver,
    amount,
    msg.sender
);
if (destination == address(0)) {
    gateway.call(
        universal,
        message,
        RevertOptions(address(this), false, address(0), message, 0)
    );
} else {
    gateway.depositAndCall{value: msg.value}(
        universal,
        message,
        RevertOptions(
            address(this),
            true,
            address(0),
            abi.encode(amount, msg.sender),
            gasLimitAmount
        )
    );
}