KittyConnect.sol::mintBridgedNFT increments the counter every time one NFT is bridged in, inflating the totalSupply with copies and creating collection ID collisions

• Description:

  • KittyConnect.sol::mintBridgedNFT increments the counter every time one NFT is bridged in. However, the ID is never subtracted, once the NFT is bridged out.

  • Once an NFT is bridged, it is transferred. Transference means the particular NFT, with those specifications, goes to another blockchain. It doesn't become something else, different.

• Impact:

  • With this approach, several duplicates will be created, inflating the total supply every time an NFT is bridged out and comes back in. It also creates collection ID collisions through all the blockchains that receive these NFTs.

• Proof of Concept:

  Add the following code to `KittyTest.t.sol`

  ​

  function testPoCNFTIdIncrementedOnNFTReturn() public {

  address DogsGuy = makeAddr("BARBA");

  bytes memory data = abi.encode(DogsGuy, "Athena", "AmericanBull", "ipfs://QmbxwGgBGrNdXPm84kqYskmcMT3jrzBN8LzQjixvkz4c62", block.timestamp, partnerA);

  uint256 catId = kittyConnect.getTokenCounter();

  ​

  vm.prank(address(kittyBridge));

  kittyConnect.mintBridgedNFT(data);

  ​

  uint256 catIdAfterBridginIn = kittyConnect.getTokenCounter();

  ​

  assertEq(catId, 0);

  assertEq(catIdAfterBridginIn, 1);

  }

  ​

• Recommendation:

  • Consider adjusting the protocol logic to allow the NFT to maintain its original ID in any blockchain.

    Adjust the code of `KittyConnect.sol::mintBridgedNFT` as follows

    ​

    function mintBridgedNFT(bytes memory data) external onlyKittyBridge {

    (

    address catOwner,

    + uint256 tokenId,

    string memory catName,

    string memory breed,

    string memory imageIpfsHash,

    uint256 dob,

    address shopPartner

    ) = abi.decode(data, (address, uint256, string, string, string, uint256, address));

    ​

    - uint256 tokenId = kittyTokenCounter;

    - kittyTokenCounter++;

    ​

    s_catInfo[tokenId] = CatInfo({

    catName: catName,

    breed: breed,

    image: imageIpfsHash,

    dob: dob,

    prevOwner: new address[](0),

    shopPartner: shopPartner,

    idx: s_ownerToCatsTokenId[catOwner].length

    });

    ​

    emit NFTBridged(block.chainid, tokenId);

    _safeMint(catOwner, tokenId);

    }

    ​