ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`mint()`, `mint_range()` and `mint_uri()` in `erc721_bridgeable.cairo` doesn't check if receiver supports ERC721

StraawHaat

Summary

The erc721_bridgeable.cairo contract uses the _mint function instead of safe_mint during token minting operations.

This oversight could lead to tokens being irreversibly sent to non-compliant contracts, resulting in the potential loss of NFTs.

Vulnerability Details

The vulnerability is present in the following functions within the ERC721BridgeableMintableImpl implementation:

  • mint

  • mint_range

  • mint_uri

impl ERC721BridgeableMintableImpl of IERC721Mintable<ContractState> {
fn mint(ref self: ContractState, to: ContractAddress, token_id: u256) {
self.ownable.assert_only_owner();
self.erc721._mint(to, token_id);
}
​
fn mint_range(ref self: ContractState, to: ContractAddress, start: u256, end: u256) {
let mut token_id = start;
loop {
if token_id == end {
break ();
}
self.mint(to, token_id);
token_id += 1_u256;
}
}
​
fn mint_uri(ref self: ContractState, to: ContractAddress, token_id: u256, token_uri: ByteArray) {
self.mint(to, token_id);
self.token_uris.write(token_id, token_uri);
}
}

The functions listed above use the _mint function to mint new ERC-721 tokens. The _mint function directly assigns tokens to the recipient without verifying whether the recipient address can handle ERC-721 tokens.

https://docs.openzeppelin.com/contracts-cairo/0.15.1/api/erc721#ERC721Component-mint

Impact

If a token is minted to a contract address that is not aware of the ERC-721 standard, the token could be permanently locked or lost because the receiving contract may not implement the necessary logic to manage or return the token.

Tools Used

Visual Studio Code

Recommendations

To mitigate the risk of token loss, it is recommended that the _mint function be replaced with safe_mint. This change will ensure that tokens are only transferred to addresses that are capable of handling ERC-721 tokens.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!