ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Escrow function to transfer an ERC1155 from the user to the contract will always fail

draiakoo

Summary

Escrow function to transfer an ERC1155 from the user to the contract will always fail

Vulnerability Details

The function that is responsible to transfer the tokens from the user that wants to bridge it to the bridge contract works as follows:

function _depositIntoEscrow(
CollectionType collectionType,
address collection,
uint256[] memory ids
)
internal
{
assert(ids.length > 0);
​
for (uint256 i = 0; i < ids.length; i++) {
uint256 id = ids[i];
​
if (collectionType == CollectionType.ERC721) {
IERC721(collection).transferFrom(msg.sender, address(this), id);
} else {
// TODO: check the supply is exactly one.
// (this is the low level call to verify if a contract has some function).
// (but it's better to check with supported interfaces? It's 2 calls instead
// of one where we control the fail.)
//(bool success, bytes memory data) = contractAddress.call("");
// @audit-issue this function will fail because the contract does not implement the ERC1155Receiver
IERC1155(collection).safeTransferFrom(msg.sender, address(this), id, 1, "");
}
​
_escrow[collection][id] = msg.sender;
}
}

As we can see, when the token to bridge is an ERC721 it uses the transferFrom function. This is an intended behavior because the bridge contract does not implement the ERC721 receiver interface so if the safeTransferFrom function would be used instead, it would fail. The same happens for the ERC1155, since the bridge contract does not implement the ERC1155 receiver interface and the method used here is the safeTransferFrom function, it will lead to the transaction reverting.

Impact

ERC1155 tokens will not be able to be bridged

Tools Used

Manual review

Recommendations

Since the ERC1155 does not implement a method to transfer tokens without executing a callback function, the only way to solve this is by inheriting the ERC1155TokenReceiver interface.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

invalid-ERC1155-not-in-scope

```compatibilities: Blockchains: - Ethereum/Starknet Tokens: - [ERC721](www.tokenstandard.com) ``` ``` function depositTokens( uint256 salt, address collectionL1, snaddress ownerL2, uint256[] calldata ids, bool useAutoBurn ) external payable { if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) { revert CairoWrapError(); } if (!_enabled) { revert BridgeNotEnabledError(); } CollectionType ctype = TokenUtil.detectInterface(collectionL1); if (ctype == CollectionType.ERC1155) { @> revert NotSupportedYetError(); } … } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!