First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Not approving link token to CCIP, making cross-chain operation not success

0xlouistsai

Summary

According to the Chainlink CCIP documentation, developer should approve proper amount of Link token to the CCIP router to process cross-chain operation. The missing of token approval in kittyBridge::bridgeNftWithData leads to DoS issue.

Vulnerability Details

In the KittyBridge::bridgeNftWithData function, developer do not approve link toke to the CCIP router by fees amount, and there is no mechanism for the contract to approve the router.

Impact

kittyBridge::bridgeNftWithData will not work successfully, making all the user unable to execute NFT cross chain operation.

Tools Used

Manual Review

Recommendations

Approve link token to CCIP router address.

function bridgeNftWithData(uint64 _destinationChainSelector, address _receiver, bytes memory _data)
external
onlyAllowlistedDestinationChain(_destinationChainSelector)
validateReceiver(_receiver)
returns (bytes32 messageId)
{
// Create an EVM2AnyMessage struct in memory with necessary information for sending a cross-chain message
Client.EVM2AnyMessage memory evm2AnyMessage = _buildCCIPMessage(_receiver, _data, address(s_linkToken));
​
// Initialize a router client instance to interact with cross-chain router
IRouterClient router = IRouterClient(this.getRouter());
​
// Get the fee required to send the CCIP message
uint256 fees = router.getFee(_destinationChainSelector, evm2AnyMessage);
​
if (fees > s_linkToken.balanceOf(address(this))) {
revert KittyBridge__NotEnoughBalance(s_linkToken.balanceOf(address(this)), fees);
}
​
// @audit-issue not approve linked token to CCIP router
+ s_linkToken.approve(this.getRouter(), fees);
​
messageId = router.ccipSend(_destinationChainSelector, evm2AnyMessage);
​
emit MessageSent(messageId, _destinationChainSelector, _receiver, _data, address(s_linkToken), fees);
​
return messageId;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing fee token approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.