First Flight #12: Kitty Connect

Summary

The function KittyConnect::_updateOwnershipInfo is utilized within the execution of KittyConnect::safeTransferFrom to update data in both the KittyConnect::s_ownerToCatsTokenId and KittyConnect::s_catInfo. However, it fails to remove the tokenId from the s_ownerToCatsTokenId[currCatOwner] array.

Vulnerability Details

The vulnerability resides within the KittyConnect contract, specifically in the _updateOwnershipInfo function, where there is no provision to update the s_ownerToCatsTokenId array for the currCatOwner.
The s_ownerToCatsTokenId array is intended to track the complete list of token IDs belonging to a specific user. It is expected that after invoking this function, the tokenId would be removed from the s_ownerToCatsTokenId array of the current owner. However, this removal does not occur.

Impact

Following the invocation of safeTransferFrom, the tokenId persists within the current user array within s_ownerToCatsTokenId, rendering the utilization of s_ownerToCatsTokenId redundant.

Tools Used

Manual review and forge were employed.
To identify this issue, execute the existing test within test/KittyTest.t.sol:

This test suite fails due to the following assertion failure:

Recommendations

It is advised to incorporate code to properly handle the s_ownerToCatsTokenId for currCatOwner:

These changes ensure proper management of s_ownerToCatsTokenId for currCatOwner, thereby addressing the identified issue.