NFTBridge
60,000 USDC
View results
Submission Details
Severity: low
Invalid

Bridged non-escrowed NFT does not have URIs and will not display properly

Summary

Bridging a StarkNet deployed NFT to L1 mints a NFT without a URI, causes the NFT on L1 not get displayed properly.

Vulnerability Details

The bridge will deploy ERC721Bridgeable for non-escrowed NFTs. Although the L2 bridge sends request with NFT URIs, the deployed bridge NFTs on L1 do not properly configure the received URI data for themself.

Impact

StarkNet deployed NFTs that bridged to L1 cannot display their pictures, which could significantly impact user experience.

Tools Used

vscode

Recommendations

Setup the consistent NFT URI accordingly.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

invalid-NFT-minted-without-baseURI-URIs-or-bridge-with-no-metadata

URI is not lost on the origin chain and it can be modified with `ERC721UriImpl`. As explained in the TODO  below, that’s a design choice and it will be implemented as a future feature. https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Bridge.sol#L206 `ERC721Bridgable` is out of scope.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.