NFTBridge
60,000 USDC
View results
Submission Details
Severity: medium
Valid

Starknet bridge contract does not check if the collection supports IERC721Metadata interface, so the ones that do not implement it will not be able to bridge NFTs

Updates

Lead Judging Commences

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

invalid-NFT-minted-without-baseURI-URIs-or-bridge-with-no-metadata

URI is not lost on the origin chain and it can be modified with `ERC721UriImpl`. As explained in the TODO  below, that’s a design choice and it will be implemented as a future feature. https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Bridge.sol#L206 `ERC721Bridgable` is out of scope.

Appeal created

haxatron Auditor
6 months ago
n0kto Lead Judge
6 months ago
n0kto Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-L2-ERC721-without-metadata-extension-wont-work

Impact: Medium/High, ERC721 tokens won’t work without the metadata extension (name + symbol), but no tokens are loss. Likelyhood: Low, All tokens not implementing name and symbol will be impacted. This should be pretty rare because the two main "libraries" to create an ERC721, have those function in their main contract and not in the metadata extension. OZ since the version 3.0.0 and Solmate since their first production release. But as anyone can also implement their own ERC721 following the EIP, it deserves a medium.

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.

Cyfrin
Updraft
CodeHawks
Solodit
Resources