Bridged non-escrowed NFT does not have URIs and will not display properly
Summary
Bridging a StarkNet deployed NFT to L1 mints a NFT without a URI, causes the NFT on L1 not get displayed properly.
Vulnerability Details
The bridge will deploy ERC721Bridgeable for non-escrowed NFTs. Although the L2 bridge sends request with NFT URIs, the deployed bridge NFTs on L1 do not properly configure the received URI data for themself.
Impact
StarkNet deployed NFTs that bridged to L1 cannot display their pictures, which could significantly impact user experience.
Tools Used
vscode
Recommendations
Setup the consistent NFT URI accordingly.
Lead Judging Commences
invalid-NFT-minted-without-baseURI-URIs-or-bridge-with-no-metadata
URI is not lost on the origin chain and it can be modified with `ERC721UriImpl`. As explained in the TODO below, that’s a design choice and it will be implemented as a future feature. https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Bridge.sol#L206 `ERC721Bridgable` is out of scope.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.