First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Free Mint Some NFT WIthout Burn on Source Chain No Access Control on KittyBridge::ccipReceive

touqeershah32

Summary

In you check closely the contract of ABI you will find one function which you can call without pay anything you can mint NFT for Free and without Burn old on source Chain

Vulnerability Details

In KittyBridge::ccipReceive function allow user to call _ccipReceive::internal function which call directly KittyConnect::mintBridgedNFT because the call is come from KittyBridge this Address is valid an transaction will go throw without any issue and free NFT on link fee or bridged fee.

ABI of ccipReceive 
In test-case you will see example of it as well.


function test_gasForCcipReceive() public {
    address sender = makeAddr("sender");
    bytes memory data = abi.encode(makeAddr("catOwner"), "meowdy", "ragdoll", "ipfs://QmbxwGgBGrNdXPm84kqYskmcMT3jrzBN8LzQjixvkz4c62", block.timestamp, partnerA);

    vm.prank(kittyConnectOwner);
    kittyBridge.allowlistSender(networkConfig.router, true);

    Client.Any2EVMMessage memory message = Client.Any2EVMMessage({
        messageId: bytes32(0),
        sourceChainSelector: networkConfig.otherChainSelector,
        sender: abi.encode(sender),
        data: data,
        destTokenAmounts: new Client.EVMTokenAmount[](0)
    });

    vm.prank(networkConfig.router);

    uint256 initGas = gasleft();
    kittyBridge.ccipReceive(message);

    uint256 finalGas = gasleft();

    uint256 gasUsed = initGas - finalGas;

    console.log("Gas Used -", gasUsed);
}




{
    "inputs": [
      {
        "components": [
          {
            "internalType": "bytes32",
            "name": "messageId",
            "type": "bytes32"
          },
          {
            "internalType": "uint64",
            "name": "sourceChainSelector",
            "type": "uint64"
          },
          {
            "internalType": "bytes",
            "name": "sender",
            "type": "bytes"
          },
          {
            "internalType": "bytes",
            "name": "data",
            "type": "bytes"
          },
          {
            "components": [
              {
                "internalType": "address",
                "name": "token",
                "type": "address"
              },
              {
                "internalType": "uint256",
                "name": "amount",
                "type": "uint256"
              }
            ],
            "internalType": "struct Client.EVMTokenAmount[]",
            "name": "destTokenAmounts",
            "type": "tuple[]"
          }
        ],
        "internalType": "struct Client.Any2EVMMessage",
        "name": "message",
        "type": "tuple"
      }
    ],
    "name": "ccipReceive",
    "outputs": [],
    "stateMutability": "nonpayable",
    "type": "function"
  },

Impact

Bypass the security Access Control and Mint NFT without pay fee on Bridge or Burn on Source Chain

Tools Used

Manual review

Recommendations

Put access control on this function by override it

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.