First Flight #12: Kitty Connect

Summary

Wrong argument passed in bridgeNftToAnotherChain cause permanent loss of NFT

Vulnerability Details

In the bridgeNftToAnotherChain function, the contract bridges the NFT from a user to another chain. The function expects as a parameter the destChainBridge which later is passed in the bridgeNftWithData function of KittyBridge contract. However, this function expects the receiver address of the NFT in this chain, not the bridge address.

Impact

NFT will be lost forever since it will moved to an address that doesn't exist or isn't the receiver's address.

Tools Used

Manual Review

Recommendations

Add as second parameter in bridgeNftToAnotherChain the receiver address of the NFT in the destination chain.