Summary

Bad logic implementation in _updateOwnershipInfo() which doesn't delete the tokenId from s_ownerToCatsTokenId[currCatOwner]

Vulnerability Details

bridgeNftToAnotherChain() logic is broken, userTokenIds is false, if (idx < (userTokenIds.length - 1)) might not be exact, getCatsTokenIdOwnedBy() view function will be wrong

Impact

getCatsTokenIdOwnedBy() view function will be wrong.

Tools Used

Manual Review

Recommendations

s_catInfo[tokenId].prevOwner.push(currCatOwner);
s_catInfo[tokenId].idx = s_ownerToCatsTokenId[newOwner].length;
s_ownerToCatsTokenId[newOwner].push(tokenId);
delete(s_ownerToCatsTokenId[newOwner][tokenId]);