In edge cases, user might lose funds when sending l1 to l2 messages due to flaw in L1KakarotMessaging.sol

[c4-bot-10]

Lines of code

https://github.com/kkrt-labs/kakarot/blob/7411a5520e8a00be6f5243a50c160e66ad285563/solidity_contracts/src/L1L2Messaging/L1KakarotMessaging.sol#L8-L9

Vulnerability details

Proof of Concept

Kakarot’s L1-L2 messaging is based on starknet’s L1-l2 mechanism using the starknet core contract(starknetMessaging).

Based on starknet doc, starknet allows a user to cancel a l1→l2 message to recover funds in case of a failed l2 execution through StarknetMessaging::startL1ToL2MessageCancellation.

The problem is kakarot’s L1KakrotMessaging.sol doesn’t provide any mechanism to invoke startL1ToL2MessageCancellation on starknet core contract. Because kakarot’s users interact with L1KakarotMessaging.sol, this means if l2 tx fails, no cancellation can be initiated on-behalf of the user, and user’s funds will be lost.

//solidity_contracts/src/L1L2Messaging/L1KakarotMessaging.sol
//@audit No method to cancel a l1->l2message (calling StarknetMessaging::startL1ToL2MessageCancellation)
interface IL1KakarotMessaging {
    function sendMessageToL2(address to, uint248 value, bytes memory data) external payable;
    function consumeMessageFromL2(address fromAddress, bytes calldata payload) external;
}

(https://github.com/kkrt-labs/kakarot/blob/7411a5520e8a00be6f5243a50c160e66ad285563/solidity_contracts/src/L1L2Messaging/L1KakarotMessaging.sol#L8-L9)

L1 sender is allowed to call any L2 evm target contract through L1KakarotMessaging::sendMessageToL2, so the need for L1 user to cancel L1 to L2 message is justified.

POC:
A special case is when kakarot core contract(kakarot.cairo) is paused by admin after L1 user initiated sendMessageToL2 call. L2 tx(handle_l1_message) will fail due to not pausing assertion. L1 user will lose funds and such cases might not be easily prevented.

Impacts:

L1 senders lose funds when Kakarot core is paused after L1-L2 message initiation, or due to other L2 tx failures.

Recommended Mitigation Steps

In L1KakarotMessaging.sol, provide an accounting of user message requests, and add functionality to cancel L1tol2 messages on starknet core contract on behalf of the user.

Assessed type

Other

[ClementWalter]

Severity: Low

Comment: Only fees would be lost as it is not a bridge. No other funds at risk. But cancellation will be implemented.

[c4-judge]

dmvt marked issue #105 as primary and marked this issue as a duplicate of 105

[c4-judge]

dmvt marked the issue as satisfactory