Submission Details
Severity:
Unsafe ERC721 Transfers
Description:
Location in Code: The
startandendfunctions.The contract uses
transfer_frominstead ofsafe_transfer_fromfor transferring NFTs.transfer_fromdoes not check if the recipient can handle ERC721 tokens.
Impact:
NFTs may be transferred to addresses or contracts that cannot manage them, effectively locking the NFT.
Recommendation:
Use
safe_transfer_fromto ensure the recipient can handle ERC721 tokens.
Proof of Code:
fn start(ref self: ContractState, bidding_duration: u64, starting_bid: u64) {
// ...
erc721_dispatcher.transfer_from(caller, receiver, self.nft_id.read().into());
// ...
}
fn end(ref self: ContractState) {
// ...
erc721_dispatcher.transfer_from(sender, self.highest_bidder.read(), self.nft_id.read().into());
// ...
}
Corrected Code:
fn start(ref self: ContractState, bidding_duration: u64, starting_bid: u64) {
// ...
erc721_dispatcher.safe_transfer_from(caller, receiver, self.nft_id.read().into());
// ...
}
fn end(ref self: ContractState) {
// ...
erc721_dispatcher.safe_transfer_from(sender, recipient, self.nft_id.read().into());
// ...
}
Rewards breakdown
nSLOC
132This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.