Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The user can block burn, burnBatch, burnBatchMultiple calls

merlin

Summary

The user can block burn, burnBatch, burnBatchMultiple calls in MembershipERC1155s.sol

Vulnerability Details

EXTERNAL_CALLER performs an external call to another contract from MembershipFactory

function callExternalContract(address contractAddress, bytes memory data) external payable onlyRole(EXTERNAL_CALLER) returns (bytes memory ) {
(bool success, bytes memory returndata) = contractAddress.call{value: msg.value}(data);
require(success, "External call failed");
return returndata;
}

The EXTERNAL_CALLER has the ability to call MembershipERC1155.burnBatch to burn all tokens held by a single user:

function burnBatch(address from) public onlyRole(OWP_FACTORY_ROLE) {
for (uint256 i = 0; i < 7; ++i) {
uint256 amount = balanceOf(from, i);
if (amount > 0) {
burn_(from, i, amount);
}
}
}

The user could be an upgradable smart contract that initially returns the correct selector when minting an NFT. However, after updating the implementation, it might return an incorrect selector, potentially blocking _burn calls.

_updateWithAcceptanceCheck
​
if (to.code.length > 0) {
try IERC1155Receiver(to).onERC1155Received(operator, from, id, value, data) returns (bytes4 response) {
if (response != IERC1155Receiver.onERC1155Received.selector) {
// Tokens rejected
--> revert IERC1155Errors.ERC1155InvalidReceiver(to);
}
}

Impact

The user can prevent the EXTERNAL_CALLER from executing burn, burnBatch, or burnBatchMultiple calls, effectively ensuring that the EXTERNAL_CALLER never burns any NFTs.

Tools Used

Manual review

Recommendations

Consider overriding the _updateWithAcceptanceCheck() function if the logic requires burning NFTs.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.