DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

mintNFT Function Lacks ERC721Receiver Check

0xaman

Summary

The user is able to mint NFt for there short record. however whi.e obervating the code the folloing vulberablity has been found.

Vulnerability Details

The audit of the shortRecord's NFT minting process revealed that the mintNFT(address asset, uint256 shortRecordId) function within the ERC721Facet contract lacks a necessary ERC721 receivable check. This omission raises concerns about potential security vulnerabilities, including the risk of NFT loss

POC

// this function would create short and mint NFT
function createShortAndMintNFTToNonERC721Receipient(address nonNft) public {
assertEq(diamond.balanceOf(address(nonNft)), 0);
assertEq(diamond.getTokenId(), 1);
fundLimitBidOpt(DEFAULT_PRICE, DEFAULT_AMOUNT, receiver);
fundLimitShortOpt(DEFAULT_PRICE, DEFAULT_AMOUNT, address(nonNft));
assertEq(diamond.balanceOf(address(nonNft)), 0);
vm.prank(address(nonNft));
diamond.mintNFT(asset, Constants.SHORT_STARTING_ID);
assertEq(diamond.getTokenId(), 2);
assertEq(diamond.balanceOf(address(nonNft)), 1);
assertEq(diamond.ownerOf(1), address(nonNft));
​
//@dev give extra an initial short to test that shortRecordId changes appropriately when
fundLimitBidOpt(DEFAULT_PRICE, DEFAULT_AMOUNT, receiver);
fundLimitShortOpt(DEFAULT_PRICE, DEFAULT_AMOUNT, extra);
}
​
function test_MintToNonERC721Recipient() public {
address nonRecipient = address(new NonERC721Recipient());
​
createShortAndMintNFTToNonERC721Receipient(nonRecipient);
// address nonRecipient = address(new NonERC721Recipient());
assertEq(diamond.balanceOf(nonRecipient), 1);
}

Impact

The NFT could be lose, No Safety and Compatibility with ERC721 standard.

Tools Used

Manual review

Recommendations

Either add SafeMint Function or add following check in side mint function:

if (!_checkOnERC721Received(address(this), msg.sender, s.tokenIdCounter, "")) {
revert Errors.ERC721InvalidReceiver(msg.sender);
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-114

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.