ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

ERC1155 Supply Mismanagement

axicnode398

Another issue surfaced in the _depositIntoEscrow function, where ERC1155 tokens were being handled. ERC1155 tokens can have multiple units (i.e., a supply greater than one), and the code was missing a crucial check to ensure that only tokens with a supply of exactly one were being escrowed.

Without this check, there was a risk of handling tokens with incorrect supply values, leading to incorrect token transfers or even the loss of tokens.

Description: The lack of a supply check for ERC1155 tokens could lead to incorrect handling of tokens with a supply greater than one, causing unexpected behavior or loss of tokens.

Location:_depositIntoEscrow function in ethereum/src/Escrow.sol.

Issue: There is a comment indicating that the supply check for ERC1155 tokens is not implemented. Without this check, it is possible that tokens with a supply greater than one could be improperly handled, leading to unexpected behavior.

Impact: Incorrect handling of ERC1155 tokens could lead to incorrect token transfers or loss of tokens.

Tools used: Manual Review.

Recommendations: Implement the supply check for ERC1155 tokens before depositing them into escrow to ensure only valid tokens are handled.

Potential changes: I added a check to ensure that only tokens with a supply of one would be deposited into escrow. This change would prevent any unexpected behavior when handling ERC1155 tokens.

function _depositIntoEscrow(
CollectionType collectionType,
address collection,
uint256[] memory ids
)
internal
{
assert(ids.length > 0);
​
for (uint256 i = 0; i < ids.length; i++) {
uint256 id = ids[i];
​
if (collectionType == CollectionType.ERC1155) {
uint256 supply = IERC1155(collection).balanceOf(msg.sender, id);
require(supply == 1, "Invalid ERC1155 token supply.");
IERC1155(collection).safeTransferFrom(msg.sender, address(this), id, 1, "");
} else {
IERC721(collection).transferFrom(msg.sender, address(this), id);
}
​
_escrow[collection][id] = msg.sender;
}
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

invalid-ERC1155-not-in-scope

```compatibilities: Blockchains: - Ethereum/Starknet Tokens: - [ERC721](www.tokenstandard.com) ``` ``` function depositTokens( uint256 salt, address collectionL1, snaddress ownerL2, uint256[] calldata ids, bool useAutoBurn ) external payable { if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) { revert CairoWrapError(); } if (!_enabled) { revert BridgeNotEnabledError(); } CollectionType ctype = TokenUtil.detectInterface(collectionL1); if (ctype == CollectionType.ERC1155) { @> revert NotSupportedYetError(); } … } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.