ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Not being an ERC721 doesn't mean being an ERC1155 for sure

0xziin

Summary

Not being an ERC721 doesn't mean being an ERC1155 for sure. There is a lot of other standards and an attacker could just create its own with malicious code, it won't be an ERC721. The contract will consider it as an ERC1155 and execute the malicious code.

==> A possible malicious code set appart, treating all non ERC721 like if they were ERC1155 will lead to problems for the user, and the protocol may not function as intended.

Vulnerability Details

https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Bridge.sol#L120-L127

In depositTokens()::Bridge.sol we can see that all non ERC721 are treated like if they were ERC1155 :

if (ctype == CollectionType.ERC721) {
(req.name, req.symbol, req.uri, req.tokenURIs) = TokenUtil.erc721Metadata(
collectionL1,
ids
);
} else {
(req.uri) = TokenUtil.erc1155Metadata(collectionL1);
}

Impact

The protocol won't work as intended if the non ERC721 is not an ERC1155.
An other possibility is that an attacker could create an non ERC721 contract with (potential) malicious code.

Tools Used

Github, VisualCode, Foundry.

Recommendations

Check if it's an ERC721, then an ERC1155, if not revert :

if (ctype == CollectionType.ERC721) {
(req.name, req.symbol, req.uri, req.tokenURIs) = TokenUtil.erc721Metadata(
collectionL1,
ids
);
} if (ctype == CollectionType.ERC1155) {
(req.uri) = TokenUtil.erc1155Metadata(collectionL1);
}else {
revert("Not ERC721 nor ERC1155");
}
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

invalid-tokens-with-other-standards-will-be-treated-like-ERC1155

No impact on the bridge or the users. If any NFT protocol use another standard with that bridge, they have to know how the bridge works and also that it doesn’t work with other standards at the moment.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.