ArkProject: NFT Bridge

Summary

Vulnerability Details

• fn erc721_metadata() always returns "" for base_uri in case of Option::Some(...), see here.

• It's then destructured here where base_uri will be an empty string, see here.

• Now here, it says for uris param:

// ERC721: must be empty if base_uri is provided, else length must match ids.
With the logic above, base_uri will always be an empty string i.e., uris.length must always match ids.

The problem is that new_owners is declared as an empty array, meaning it's length will always be 0 and uris.length won't match ids. The test suite fails to spot that because requests are constructed manually:

Sponsors also confirmed that:

Yes base_uri will always be an empty string. There is no method in Starknet ERC721 interface to retrieve base_uri.
Yes uris and ids must have the same length.

Impact

Incompliance with ERC721, the impact would be requests failures and denial of service.

Tools Used

Manual review.

Recommendations

Implement the full logic to allow uris and new_owners usage.