First Flight #12: Kitty Connect

First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Submission Details
Severity: medium
Invalid

`mintBridgedNFT` can revert due to `_safeMint`, resulting in the loss of NFTs on both chains

[M-1] mintBridgedNFT can revert du to _safeMint and lose NFT on both chain

Description

In the mintBridgedNFT function, the NFT is minted on the destination chain after being burned on the source chain during a bridge operation. However, _safeMint is used without checking whether the bridge operation is successful. If _safeMint reverts, the NFT will be lost on both chains.

function mintBridgedNFT(bytes memory data) external onlyKittyBridge {
...
emit NFTBridged(block.chainid, tokenId);
@> _safeMint(catOwner, tokenId);
}

Risk

Likelyhood: Low

  • If _safeMint reverts.

Impact: High

  • NFT is burned on both chain.

Proof of Concept

  • Create a simple contract without implementing a receive function for NFTs.

  • Bridge an NFT to this contract.

  • Check that the NFT doesn't exist on both chain.

Recommended Mitigation

  • Use _mint instead of _safeMint.

Alternatively:

  • Mint the NFT for the bridge and implement a withdraw function for the owner on the destination chain.

  • Implement a rescue function to transfer stucked NFTs.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.