First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

kittyConnect::mintBridgedNFT does not update s_ownerToCatsTokenId information, leading to DoS issue in `kittyConnect::bridgeNftToAnotherChain`

0xlouistsai

Summary

In the kittyConnect::mintCatToNewOwner, when a new NFT is minted, the s_ownerToCatsTokenId is updated before safeMint operation, however, the kittyConnect::mintBridgedNFT function mints NFT without updating the value.

Vulnerability Details

In the kittyConnect::mintCatToNewOwner, when a new NFT is minted, the s_ownerToCatsTokenId is updated before safeMint operation, however, the kittyConnect::mintBridgedNFT function mints NFT without updating the value.

Impact

User might be confused when interacting with s_ownerToCatsTokenId related methods, such as kittyConnect::getCatsTokenIdOwnedBy. And some operation might have unintended behavior when kittyConnect::bridgeNftToAnotherChain execute pop operation of s_ownerToCatsTokenId array.

Tools Used

Manual Review

Recommendations

Update the s_ownerToCatsTokenId in the function

function mintBridgedNFT(bytes memory data) external onlyKittyBridge {
(
address catOwner,
string memory catName,
string memory breed,
string memory imageIpfsHash,
uint256 dob,
address shopPartner
) = abi.decode(data, (address, string, string, string, uint256, address));
​
uint256 tokenId = kittyTokenCounter;
kittyTokenCounter++;
​
s_catInfo[tokenId] = CatInfo({
catName: catName,
breed: breed,
image: imageIpfsHash,
dob: dob,
prevOwner: new address[](0),
shopPartner: shopPartner,
idx: s_ownerToCatsTokenId[catOwner].length
});
​
emit NFTBridged(block.chainid, tokenId);
+ s_ownerToCatsTokenId[catOwner].push(tokenId);
_safeMint(catOwner, tokenId);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

owner's token ID array not updated in `mintBridgedNFT`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.