First Flight #12: Kitty Connect

Summary

Users will lose their NFT when they bridge NFT to another chain.
User calls KittyConnect.bridgeNftToAnotherChain()
NFT will be burned
KittyBridge.bridgeNftWithData() is called
Send the request to CCIP(Here the transaction will not work as fees approval are not given)

Vulnerability Details

KittyBridge.bridgeNftWithData() should approve the fees and then call router.ccipSend. But Token fees approval to router is missing. Due to this, KittyBridge._ccipReceive() function will never be called. As NFT is burned and is not minted in another chain and there is no revert anywhere, owner is bound to lose their NFT.
Add this line before calling ccipSend - s_linkToken.approve(address(router), fees);

Impact

Owners will lose their NFTs

Tools Used

1. Visual Studio Code & Foundry

2. Remix

Recommendations

Short Term solution:
Add below line inside KittyBridge.bridgeNftWithData function before router.ccipSend call
s_linkToken.approve(address(router), fees);

Long Term solution:
Implement Pausable & Upgradradable contracts to quickly avoid further NFT owner loss and rectify the issue without users changing to new contract address.