No way to cancel l1 -< l2 messages

[howlbot-integration]

Lines of code

https://github.com/kkrt-labs/kakarot/blob/7411a5520e8a00be6f5243a50c160e66ad285563/solidity_contracts/src/L1L2Messaging/L1KakarotMessaging.sol#L26-L61

Vulnerability details

Description

There is no api to allow cancellation of l1->l2 messages. In the event of an issue in the kakarot contracts, this will result in the fee being permanently lost since the user has no ability to reclaim the funds.
https://github.com/kkrt-labs/kakarot/blob/7411a5520e8a00be6f5243a50c160e66ad285563/solidity_contracts/src/L1L2Messaging/L1KakarotMessaging.sol#L26-L61
As we can see there are only functions to either send the message from l1 -> l2 or consume an l2 message. There is no cancelL1toL2Message present.

Recommended Mitigation Steps

https://docs.starknet.io/architecture-and-concepts/network-architecture/messaging-mechanism/#l2-l1_message_cancellation
Introduce the following API to let users cancel their messages after waiting the time limit so that they can reclaim funds.

Assessed type

Context

[ClementWalter]

Severity: Low

Comment: Only fees would be lost as it is not a bridge. No other funds at risk. But cancellation will be implemented.

[c4-judge]

dmvt marked the issue as selected for report

[dmvt]

Fee loss is still a value leak / loss of funds. Medium is appropriate.

[obatirou]

As per the doc, see https://docs.code4rena.com/awarding/judging-criteria/severity-categorization#loss-of-fees-as-low

loss of fees is a LOW

[dmvt]

Loss of fees should be regarded as an impact similar to any other loss of capital

Context: I helped write this rule as one of the 3 SC judges that agreed on it.

Loss of unmatured yield or yield in motion shall be capped to medium severity.

The intent is that loss of fees is not higher than medium, even if they are substantial yield rewards.

Loss of dust amounts are QA

Only loss of dust is specifically stated as low.

Loss of real amounts depends on specific conditions and likelihood considerations.

The condition above is very likely, making this a valid medium.