ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

NFTs will be locked if bridge to contracts without `onERC721Received` implementation

gajiknownnothing

Summary

If a contract does not implement the onERC721Received, it cannot withdraw escrowed NFTs due to ERC721::safeTransferFrom(), resulting in NFTs being locked.

Vulnerability Details

The Escrow::_withdrawFromEscrow() function withdraws NFTs using the safeTransferFrom() method, which requires the receiving contract to implement the onERC721Received interface. If the receiving contract does not implement this interface, the transfer will fail, resulting in the NFTs being locked:

File: Escrow.sol
63: function _withdrawFromEscrow(
...
78: if (collectionType == CollectionType.ERC721) {
79: > IERC721(collection).safeTransferFrom(from, to, id);
80: } else {
81: // TODO:
82: // Check here if the token supply is currently 0.
83: IERC1155(collection).safeTransferFrom(from, to, id, 1, "");
84: }

This issue can occur in the following cases:

  1. A user can transfer NFTs to a contract that does not implement onERC721Received using the ERC721::transferFrom() method. If this contract then attempts to bridge NFTs and subsequently cancels the request, the cancelRequest() transaction will revert, causing the NFTs to be locked.

  2. If NFTs are bridged from L2 to a L1 contract that does not implement onERC721Received, the NFTs cannot be withdrawn, leading to them being permanently locked.

Impact

NFTs being locked.

Tools Used

vscode

Recommendations

Utilizing ERC721::transferFrom() to transfer NFTs instead.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-withdraw-safeTransferFrom-to-no-onERC721Received-will-revert

Impact: High, NFT will be stuck in L2 bridge. Likelyhood: Very low, sending NFT to a contract not implementing that function would almost be a user error.

Appeal created

bladesec Auditor
9 months ago
n0kto Lead Judge
9 months ago
n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-withdraw-safeTransferFrom-to-no-onERC721Received-will-revert

Impact: High, NFT will be stuck in L2 bridge. Likelyhood: Very low, sending NFT to a contract not implementing that function would almost be a user error.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.