stake.link

Summary

When token is sent from one chain to another, then approved contract for it is not erased, which can lead to loss of token.

Vulnerability Details

SDL nft tokens can be bridged to other chain using RESDLTokenBridge. During the call sdlPoolCCIPController.handleOutgoingRESDL function is called. This function will decrease user balance and remove lock info. But it doesn't clear tokenApprovals. When token comes to the destination chain the it also doesn't use tokenApprovals.

Because of that next attack is possible. Attacker owns lock and approves it to his controlled address. Then attacker bridges nft to other chain and sells it there. Now attacker waits, when victim will bridge nft back to the original chain. Once it's done, then attacker transfers that nft and steals it.

Impact

Possible to steal nft.

Tools Used

VsCode

Recommendations

When bridge token, then remove all approvals.