Summary

The function bridgeNftWithData allows everyone to mint tokens on the destination chain even if they don't have an NFT on the source chain.

Vulnerability Details

The function bridgeNftWithData(uint64 _destinationChainSelector, address _receiver, bytes memory _data) is not protected, so everyone can call it directly on the destination chain on contract kittyBridge, this function by providing the _destinationChainSelector and receiver address.(KittyBridge address on destination chain)

Impact

Attackers can mint new NFTs on the destination chain even if they don't have NFT on the source chain.

Tools Used

manual

Recommendations

Add a check in the smart contract to check if the function is called by the router of the destination chain.