ArkProject: NFT Bridge

Summary

Vulnerability Detail

The TokenUtil library provides utility functions for handling different token standards, including ERC721 and ERC1155. One of its key functions is erc1155Metadata(), which is intended to retrieve metadata from ERC1155 tokens. However, the current implementation of this function is severely flawed, potentially allowing attackers to bypass important checks and manipulate the metadata retrieval process.

The erc1155Metadata() function is designed to check if a given collection address supports the ERC1155 metadata interface and then return the appropriate metadata. However, the current implementation always returns an empty string, regardless of the input:

This implementation effectively nullifies any checks or validations that should be performed on the ERC1155 token contract. As a result, any system relying on this function to validate or retrieve ERC1155 metadata will receive an empty string, potentially leading to incorrect assumptions about the token's properties or capabilities.

Impact

The impact of this issue is significant. Systems relying on the erc1155Metadata() function to validate or retrieve ERC1155 token metadata will receive no useful information, potentially leading to:

1. Incorrect validation of ERC1155 tokens, allowing non-compliant or malicious contracts to be treated as valid ERC1155 tokens.

2. Failure to retrieve essential metadata, which could affect token display, functionality, or integration with other systems.

Tools Used

Manual review

Recommended Mitigation Steps

The erc1155Metadata() function should be properly implemented to perform the necessary checks and retrieve the actual metadata. Here's a suggested fix:

This implementation:

1. Checks if the contract supports the IERC1155MetadataURI interface.

2. If supported, it retrieves and returns the URI for the specified token ID.

3. If not supported, it returns an empty string, maintaining the current behavior for non-compliant contracts.