QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Contract Recipient Validation in `lpNFT` Token Transfers

0xexploud

Summary

The lpNFT contract lacks proper validation when transferring tokens to contract addresses, allowing the use of unsafe transfer methods that could result in irreversible token lockup.

Vulnerability Details

The lpNFT contract extends ERC721 but doesn't enforce safe transfer practices :
https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/LPNFT.sol#L49-L56

contract LPNFT is ERC721 {
// No override of transferFrom to enforce safety checks
// Only overrides _update for router updates
function _update(address to, uint256 tokenId, address auth) internal override returns (address previousOwner) {
previousOwner = super._update(to, tokenId, auth);
if (to != address(0) && previousOwner != address(0)) {
router.afterUpdate(previousOwner, to, tokenId);
}
}
}

Key issues:

  1. Direct use of transferFrom remains possible

  2. No validation of contract recipients' ability to handle ERC721 tokens

Impact

Irreversible loss of LP positions if tokens are sent to incompatible contracts

Tools Used

VSCode

Recommendations

Implement strict transfer controls:

contract LPNFT is ERC721 {
error UnsafeTransferToContract();
function transferFrom(address from, address to, uint256 tokenId) public virtual override {
if (to.code.length > 0) {
revert UnsafeTransferToContract();
}
super.transferFrom(from, to, tokenId);
}
}

This ensures only safeTransferFrom can be used for contract recipients, preventing accidental token lockup while maintaining the protocol's core functionality.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.