First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incomplete updating of owner token IDs in KittyConnect::mintBridgedNFT

insomnia

Summary

The KittyConnect::mintBridgedNFT function aims to mint the token received from the bridge and update the state variables accordingly. However, it currently fails to update the s_ownerToCatsTokenId[catOwner] variable.

Vulnerability Details

  • The vulnerability lies within the KittyConnect contract, specifically in the mintBridgedNFT function, where state changes for the s_ownerToCatsTokenId variable are not handled.

  • It is expected that the function would append the new tokenId to s_ownerToCatsTokenId[catOwner], but this action is currently omitted.

Impact

  • Upon receiving a bridged token from the source chain, the tokenId will not be added to s_ownerToCatsTokenId[catOwner], resulting in an inaccurate list of owner token IDs.

Tools Used

Manual review and 'forge'.

To replicate the issue, add the following test suite to the tests file test/KittyConnect.t.sol:

function test_mintBridgedNFTNotUpdateOwnerToCatsTokenId() public {
address randomOwner = makeAddr("randomOwner");
vm.prank(address(kittyBridge));
bytes memory data = abi.encode(randomOwner, "Tom", "breed", "hash", block.timestamp, partnerA);
kittyConnect.mintBridgedNFT(data);
assert(kittyConnect.getCatsTokenIdOwnedBy(randomOwner).length == 1);
}

Subsequently, execute this test suite:

forge test --mt test_mintBridgedNFTNotUpdateOwnerToCatsTokenId

This test will fail.

Recommendations

Integrate the following changes into the mintBridgedNFT function:

s_catInfo[tokenId] = CatInfo({
catName: catName,
breed: breed,
image: imageIpfsHash,
dob: dob,
prevOwner: new address ,
shopPartner: shopPartner,
idx: s_ownerToCatsTokenId[catOwner].length
});
​
+. s_ownerToCatsTokenId[catOwner].push(tokenId);
emit NFTBridged(block.chainid, tokenId);
_safeMint(catOwner, tokenId);

These modifications ensure that mintBridgedNFT correctly updates the s_ownerToCatsTokenId[catOwner] variable, thereby resolving the identified vulnerability.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

owner's token ID array not updated in `mintBridgedNFT`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.