First Flight #12: Kitty Connect

Summary

The smart contract does not ensure that the s_linkToken is approved before attempting to send a cross-chain NFT message using the KittyBridge::bridgeNftWithData function. This omission prevents the contract from spending the required LINK tokens to pay for the cross-chain message transmission, leading to transaction failure.

Vulnerability Details

• The KittyBridge::bridgeNftWithData function attempts to send a cross-chain NFT message by calling the router.ccipSend function.

• The router.ccipSend function requires the contract to have an approved balance of LINK tokens to cover the fees for the message transmission.

• The contract does not include a call to s_linkToken.approve(address(router), fees) before attempting to send the message, leading to a failure in the transaction.

Impact

Without the necessary approval, the contract cannot pay the fees for sending NFTs across chains, effectively blocking the functionality of bridging NFTs in LINK tokens. This issue impacts the contract's ability to facilitate cross-chain NFT transactions, potentially leading to a loss of functionality for users relying on this feature.

Tools Used

Manual review

Recommendations

• Implement a step in the KittyBridge::bridgeNftWithData function to ensure that the s_linkToken is approved for the router contract to spend the required amount of LINK tokens.

• This can be achieved by adding a call to s_linkToken.approve(address(router), fees) before the router.ccipSend function call.

• Ensure that the contract owner or an authorized entity has sufficient LINK tokens to cover the fees for the message transmission.

This mitigation ensures that the contract has the necessary approval to spend the LINK tokens, allowing it to successfully send cross-chain NFT messages and fulfill its intended functionality.