QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Transferring an NFT to oneself deletes the wrong NFT

ryonen

Summary

If a user transfers an NFT to the same address (from == to), it causes the wrong NFT to be deleted.

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L624-L625

delete feeDataArray[feeDataArrayLength - 1];
feeDataArray.pop();

In the hypothetical case where the user has only one NFT (index 0), it would be deleted, and the recently transferred NFT would be popped.

Impact

  • Loss of user funds.

Tools Used

Manual Review

Recommendations

Prevent transfers where from == to.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_afterUpdate_erase_self_transfer

Likelihood: Low, when users wants to transfer tokens they already own to themselves. Impact: High, funds loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!