60,000 USDC
Submission Details
Severity:
If NFT transferred to contract that doesn't implement onERC721Received hook, cross-chain transfer will be bricked
function _withdrawFromEscrow(
CollectionType collectionType,
address collection,
address to,
uint256 id
)
internal
returns (bool)
{
if (!_isEscrowed(collection, id)) {
return false;
}
address from = address(this);
if (collectionType == CollectionType.ERC721) {
IERC721(collection).safeTransferFrom(from, to, id);
}
_escrow[collection][id] = address(0x0);
return true;
}
During a L2 -> L1 NFT withdrawal, the solidity bridge will transfer back the NFT from the escrow to the user via safeTransferFrom if the recipient is a contract that does not implement the onERC721Received hook, call will always revert and the NFT will be stuck. The solution would be to use transferFrom to not trigger the onERC721Received hook
Updates
Lead Judging Commences
n0kto 12 months ago
Submission Judgement Published Assigned finding tags:
finding-withdraw-safeTransferFrom-to-no-onERC721Received-will-revert
Impact: High, NFT will be stuck in L2 bridge. Likelyhood: Very low, sending NFT to a contract not implementing that function would almost be a user error.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.