ArkProject: NFT Bridge

Summary:

The function erc721Metadata retrieves metadata for a list of ERC721 token IDs without explicitly checking if each token has been minted. This can lead to potential issues where metadata is fetched for non-existent tokens, which could cause unexpected behavior or errors.

Vulnerability Details:

If the base URI is not available, the function iterates over the tokenIds array.
For each token ID, it calls c.tokenURI(tokenIds[i]) to get the individual token URI.

By invoking the c.tokenURI method for a maliciously provided NFT id, the returned data may deceive potential users, as the method will return data for a non-existent NFT id that appears to be a genuine . This can lead to a poor user experience or financial loss for users.
Violation of the ERC721-Metadata part standard

Example:

User creates a fake contract A simple example so that the tokenURI method does not revert:

User deploy the contract
Now, by using tokenURI() for the deployed user's address, one can fetch information about a non-existent NFT.

reference:
https://eips.ethereum.org/EIPS/eip-721

Impact:

• Data Integrity: Fetching metadata for non-existent tokens can lead to incorrect data being processed or displayed.

• Security: Malicious actors could exploit this to manipulate or flood the system with invalid token IDs, potentially causing denial of service or other unexpected behaviors.

Tools Used:

Manual review

Recommendations:

Implement a check to ensure that each token ID in tokenIds has been minted or valid before attempting to retrieve its metadata. This can be done by verifying ownership or existence of the token using the ownerOf function for ERC721 tokens.