First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Front Run or Lose Paid Link fee to used bridge KittyConnect::bridgeNftToAnotherChain

touqeershah32

Summary

When we have to used CCIP we have to pay some fee as charges to used Chinelink either native currency or link token. In this contract when user want to used KittyConnect::bridgeNftToAnotherChain to transfer NFT from one chain to other he pay some fee but not in KittyConnect::bridgeNftToAnotherChain or KittyBridge::bridgeNftWithData check the person or address call the function pay the fee or someone else call this functions.

Vulnerability Details

Person A pay fee before he call KittyConnect::bridgeNftToAnotherChain to used it Person B call KittyConnect::bridgeNftToAnotherChain and transfer his tokene without pay anything.

Person A lose his fund and not able to used the platform.

function test_bridgeNftWithDataIfDestinationIsAllowlisted() public {
address personA = makeAddr("personA");
address personB = makeAddr("personA");
​
bytes memory data = abi.encode(makeAddr("catOwner"), "meowdy", "ragdoll", "ipfs://QmbxwGgBGrNdXPm84kqYskmcMT3jrzBN8LzQjixvkz4c62", block.timestamp, partnerA);
vm.prank(address(personA));
@> IERC20(networkConfig.link).transfer(address(kittyBridge), linkBalance);
vm.prank(address(kittyConnect));
@> kittyBridge.bridgeNftWithData(networkConfig.otherChainSelector, personA, data);
​
}

As you see on both line in test one person pay fee before he call kittyBridge.bridgeNftWithData someone else found in transactions and run his transaction on your fee.

Impact

Lose of fund

Tools Used

Manual

Recommendations

LINK is an ERC-677 compliant token which implements transferAndCall, a function that allows tokens to be transferred whilst also triggering logic in the receiving contract within a single transaction.

Used following approached to keep track of Link transfer by different User with KittyBridge.

mapping(address => uint256) private amounts;
​
function onTokenTransfer(address sender, uint256 amount, bytes calldata data) public override {
amounts[sender] += amount;
emit ReceivedCalled(sender, amount);
}

Add check inside the

contract KittyBridge is KittyBridgeBase, CCIPReceiver, Ownable {
...
function bridgeNftWithData(uint64 _destinationChainSelector, address _receiver, bytes memory _data)
external
onlyAllowlistedDestinationChain(_destinationChainSelector)
validateReceiver(_receiver)
returns (bytes32 messageId)
{
......
+ if (amounts[userAddress] < fee) {
+ revert InsufficientBalance(userAddress);
+ }
......
​
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.