First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`s_ownerToCatsTokenId` is not updated with the tokenId in `mintBridgedNFT` function on destination chain

naman1729

Summary

  • mintBridgedNFT function is used to mint the bridged NFT on the destination chain is not updating s_ownerToCatsTokenId mapping with the tokenId which can leads to the inconsistency in the mapping

Vulnerability Details

  • mintBridgedNFT function is used to mint the bridged NFT on the destination chain is not updating s_ownerToCatsTokenId mapping with the tokenId which can leads to the inconsistency in the mapping

  • getCatsTokenIdOwnedBy function will not return wrong tokenId which is not updated in the s_ownerToCatsTokenId

function mintBridgedNFT(bytes memory data) external onlyKittyBridge {
(
address catOwner,
string memory catName,
string memory breed,
string memory imageIpfsHash,
uint256 dob,
address shopPartner
) = abi.decode(data, (address, string, string, string, uint256, address));
​
uint256 tokenId = kittyTokenCounter;
kittyTokenCounter++;
​
s_catInfo[tokenId] = CatInfo({
catName: catName,
breed: breed,
image: imageIpfsHash,
dob: dob,
prevOwner: new address[](0),
shopPartner: shopPartner,
idx: s_ownerToCatsTokenId[catOwner].length
});
@>
emit NFTBridged(block.chainid, tokenId);
_safeMint(catOwner, tokenId);
}

POC

  • These are the steps : -

    • first we call bridgeNftToAnotherChain function with destChainSelector, destChainBridge, tokenId as parameter

    • then, All bridging call completes like bridgeNftWithData and _ccipReceive. then, _ccipReceive function calls mintBridgedNFT

    • In mintBridgedNFT function, we can see that s_catInfo[tokenId] is assigned with the data passed in the function. but, s_ownerToCatsTokenId is not updated with the tokenId which can leads to the inconsistency in the mapping

    • If this inconsistency is not handled properly, it can lead loss of NFT which is lock at that chain and we can not able to Bridge it.

Impact

  • s_ownerToCatsTokenId is not updated with the tokenId which can leads to the inconsistency in the mapping

  • We can not able to bridge the NFT which is lock at that chain

  • getCatsTokenIdOwnedBy function will not return wrong tokenId which is not updated in the s_ownerToCatsTokenId

Tools Used

  • Manual review

Recommendations

  • Here, we can update the s_ownerToCatsTokenId mapping with the tokenId to avoid the inconsistency in the mapping.

function mintBridgedNFT(bytes memory data) external onlyKittyBridge {
(
address catOwner,
string memory catName,
string memory breed,
string memory imageIpfsHash,
uint256 dob,
address shopPartner
) = abi.decode(data, (address, string, string, string, uint256, address));
​
uint256 tokenId = kittyTokenCounter;
kittyTokenCounter++;
​
s_catInfo[tokenId] = CatInfo({
catName: catName,
breed: breed,
image: imageIpfsHash,
dob: dob,
prevOwner: new address[](0),
shopPartner: shopPartner,
idx: s_ownerToCatsTokenId[catOwner].length
});
​
+ s_ownerToCatsTokenId[catOwner].push(tokenId);
​
emit NFTBridged(block.chainid, tokenId);
_safeMint(catOwner, tokenId);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

owner's token ID array not updated in `mintBridgedNFT`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.