The Standard

Summary

_afterTokenTransfer() purpose is to give the ownership address to the to address. However, it misses to delete the from approvals before transferring the vault.

Vulnerability Details

Here is a simple rundown of the issue:

• Alice is the owner of a vault (Token Id 1)

• She approved Jim to use the vault

• After a few days, Alice sold the vault to bob.

• Bob is now the owner of the vault (Token Id 1). However, Alice approvals are not revoked.

• Thus, if at some point in the future the vault get back to Alice, she won't remember || know that Jim still have access to transfer the vault.

• Jim can now steal the vault from Alice by transferring the vault to himself.

Here is a coded PoC to demonstrate the issue:

Test Setup:

• Incorporate this gist in the tests folder.

• Execute: forge test --mt testApprovals -vvv

Impact

Previously approved users can hijack the vault from the owner.

Tools Used

Manual review

Recommendations

Reset the owner approvals before transferring the vault.