ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Use of unsafe transferFrom instead of safeTransferFrom in ERC721 token transfer

salem

Summary

In the _depositIntoEscrow function, the contract uses transferFrom instead of safeTransferFrom when transferring ERC721 tokens. This is a significant vulnerability that can lead to permanent loss of tokens as the unsafe transfer can silently fail.

Vulnerability Details

Escrow.sol
46 IERC721(collection).transferFrom(msg.sender, address(this), id); // @bug

Impact

Lack of Safety Checks: transferFrom does not perform checks to ensure the receiving address can handle ERC721 tokens, potentially leading to unintended behavior or loss of assets.

Tools Used

Manual Review

Recommendations

IERC721(collection).safeTransferFrom(msg.sender, address(this), id);
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.