ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Using `transfer_from` may cause the user's NFT to be frozen in a contract that does not support ERC721

745fe9f9c2

Summary

There are certain smart contracts that do not support ERC721, using transfer_from() may result in the NFT being sent to such contracts.

Vulnerability Details

inside bridge contract in function withdraw_auto_from_l1 the contract use transfer_from which it unsafe

OpenZeppelin’s documentation discourages the use of transfer_from

WARNING: This method may lead to the loss of tokens if to is not aware of the ERC721

fn withdraw_auto_from_l1(
ref self: ContractState,
from_address: felt252,
req: Request
) {
---snip---
IERC721Dispatcher { contract_address: collection_l2 }
.transfer_from(from, to, token_id); //@audit unsafe transfer
} else {
---snip---

Impact

While unlikely because the recipient is the function caller, there is the potential loss of NFTs should the recipient is unable to handle the sent ERC721s.

Tools Used

Manual Review

Recommendations

Use safe_transfer_from when sending out the NFT

Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Appeal created

745fe9f9c2 Submitter
11 months ago
n0kto Lead Judge
11 months ago
n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.