First Flight #12: Kitty Connect

Summary

Currentu KittyConnect has function safeTransferFrom() which can be called by Shop partners only. But there is a another function(safeTransferFrom with 3 argument or transferFrom() functions) in ERC721 which can be called by NFT owners directly which will leads to incorrect data in s_catInfo variable as it will not be updated by transfer() function

Vulnerability Details

safeTransferFrom() with 3 aguments or Transferfrom() function can be called by User to transfer NFT to someone else. These functions will not update data in s_catInfo. As current owner, new owners are not changes, it can lead to lot of confusion to the end users.

Impact

Will be lot of confusion to the end users.

Tools Used

VS code, Foundry

Recommendations

Override other functions and revert it (or) dont add any code in it, so if someone calls there is no NFT transfer happens.