Submission Details
Severity:
Not safe macro _MINT() - doesn't check function onERC721Received for the contracts
Summary
macro _MINT() doesn't check function onERC721Received for the contracts
Vulnerability Details
macro MINT_HORSE() uses macro _MINT() and it doesn't check function onERC721Received for the contracts
PoC:
abstract contract Base_Test is Test {
HorseStore horseStore;
string public constant NFT_NAME = "HorseStore";
string public constant NFT_SYMBOL = "HS";
function setUp() public virtual {
horseStore = new HorseStore();
}
function testContractMint() public {
vm.expectRevert();
vm.prank(address(this));
horseStore.mintHorse();
}
Run:
forge test --mt testContractMint -vvv
Result:
Running 1 test for test/HorseStoreSolidity.t.sol:HorseStoreSolidity
[PASS] testContractMint() (gas: 88622)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 50.11ms
Running 1 test for test/HorseStoreHuff.t.sol:HorseStoreHuff
[FAIL. Reason: call did not revert as expected] testContractMint() (gas: 57246)
Traces:
[57246] HorseStoreHuff::testContractMint()
├─ [0] VM::expectRevert(custom error f4844814:)
│ └─ ← ()
├─ [0] VM::prank(HorseStoreHuff: [0x34A1D3fff3958843C43aD80F30b94c510645C316])
│ └─ ← ()
├─ [48831] 0x6d2eed85750d316088343D6d5e91ca59eb052768::61fc6a67()
│ ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: HorseStoreHuff: [0x34A1D3fff3958843C43aD80F30b94c510645C316], tokenId: 0)
│ └─ ← ()
└─ ← call did not revert as expected
Test result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 1.93s
Ran 2 test suites: 1 tests passed, 1 failed, 0 skipped (2 total tests)
Failing tests:
Encountered 1 failing test in test/HorseStoreHuff.t.sol:HorseStoreHuff
[FAIL. Reason: call did not revert as expected] testContractMint() (gas: 57246)
Encountered a total of 1 failing tests, 1 tests succeeded
So it passed for solidity version and failed for Huff version.
Impact
Tokens may be lost for use when minted through a contract
Tools Used
Forge test
Recommendations
Implement onERC721Received check for _MINT macro
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Components of ERC721 not properly (or at all) implemented in HUFF
Rewards breakdown
nSLOC
460This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.