First Flight #12: Kitty Connect

Summary

Function safeTransferFrom in KittyConnect.sol contract is overridden and extends the basic method of ERC721 by calling internal function _updateOwnershipInfo to update the values of contract storage and emits CatTransferredToNewOwner event. However, the ERC721 contract has another transfer from method, which allows to sending NFT to another owner without calling _updateOwnershipInfo and emitting the CatTransferredToNewOwner event.

This creates problems with bridging NFT to another chain idx оf token will not be updated and this will lead to an EVM error, or removing of another token id from s_ownerToCatsTokenId mapping.

Impact

High.

Recommendations

Override transferFrom method to either make it unavailable for users or add custom logic from safeTransferFrom method to it