First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

mintBridgedNFT does not update nft data correctly

josh4324

Summary

The mintBridgedNFT function, which is called by the KittyBridge contract in the _ccipReceive() function, is responsible for minting bridged NFTs on the destination chain. However, the function does not update the s_ownerToCatsTokenId mapping, which is used to track the token IDs owned by each user. This leads to an incomplete update of the token data on the new chain, potentially causing inconsistencies and issues with ownership tracking.

Vulnerability Details

When the mintBridgedNFT is triggered a new token is created on the new chain but the new tokenId is not added to the s_ownerToCatsTokenId mapping array which leads to the idx part of the CatInfo Struct not getting the correct information as it depends on the s_ownerToCatsTokenId array to track the number of nfts the user hold and use it to generate an idx in the Catinfo Struct for the nft.

function mintBridgedNFT(bytes memory data) external onlyKittyBridge {
(
address catOwner,
string memory catName,
string memory breed,
string memory imageIpfsHash,
uint256 dob,
address shopPartner
) = abi.decode(data, (address, string, string, string, uint256, address));
​
uint256 tokenId = kittyTokenCounter;
kittyTokenCounter++;
​
s_catInfo[tokenId] = CatInfo({
catName: catName,
breed: breed,
image: imageIpfsHash,
dob: dob,
prevOwner: new address[](0),
shopPartner: shopPartner,
idx: s_ownerToCatsTokenId[catOwner].length
});
​
emit NFTBridged(block.chainid, tokenId);
_safeMint(catOwner, tokenId);
}

Impact

  1. Ownership Tracking Issues: Failing to update the s_ownerToCatsTokenId mapping can result in incorrect ownership information, making it difficult to accurately track which tokens belong to each user on the destination chain.

  2. Data Integrity Concerns: The incomplete update of token data can lead to inconsistencies between the actual token ownership and the recorded data, potentially causing issues with future operations involving those tokens.

  3. User Experience Degradation: Users may experience confusion or unexpected behavior when interacting with their bridged NFTs if the ownership information is incorrect or incomplete.

  4. Potential Security Vulnerabilities: Incomplete or incorrect token data can potentially introduce security vulnerabilities, such as unauthorized access or manipulation of token ownership.

POC

function mintBridgedNFT(bytes memory data) external onlyKittyBridge {
(
address catOwner,
string memory catName,
string memory breed,
string memory imageIpfsHash,
uint256 dob,
address shopPartner
) = abi.decode(data, (address, string, string, string, uint256, address));
​
uint256 tokenId = kittyTokenCounter;
kittyTokenCounter++;
​
s_catInfo[tokenId] = CatInfo({
catName: catName,
breed: breed,
image: imageIpfsHash,
dob: dob,
prevOwner: new address[](0),
shopPartner: shopPartner,
idx: s_ownerToCatsTokenId[catOwner].length
});
​
// The tokenId should be pushed to s_ownerToCatsTokenId[catOwner] at this point
​
emit NFTBridged(block.chainid, tokenId);
_safeMint(catOwner, tokenId);
}

Tools Used

VS Code, Foundry and Manual Review

Recommendations

The code should be updated to push the tokenId to s_ownerToCatsTokenId[catOwner].

function mintBridgedNFT(bytes memory data) external onlyKittyBridge {
(
address catOwner,
string memory catName,
string memory breed,
string memory imageIpfsHash,
uint256 dob,
address shopPartner
) = abi.decode(data, (address, string, string, string, uint256, address));
​
uint256 tokenId = kittyTokenCounter;
kittyTokenCounter++;
​
s_catInfo[tokenId] = CatInfo({
catName: catName,
breed: breed,
image: imageIpfsHash,
dob: dob,
prevOwner: new address[](0),
shopPartner: shopPartner,
idx: s_ownerToCatsTokenId[catOwner].length
});
​
+ s_ownerToCatsTokenId[catOwner].push(tokenId);
​
emit NFTBridged(block.chainid, tokenId);
_safeMint(catOwner, tokenId);
}
​
​
​
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

owner's token ID array not updated in `mintBridgedNFT`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.