Summary

When user divides a token from an NFT that already has been divided (for another tokenId), the previously divided token is locked in the contract.

Vulnerability Details

The nftToErc20Info mapping contains information for divided NFT and its value is changed in function TokenDivider::divideNft:

However, the mapping value is overwritten every time when a token from the same NFT is divided. Let's consider the scenario below:

1. User A divides token with id 1 of the NFT. The nftToErc20Info[nftAddress] value is set to data for ERC20 token for the token with id 1

2. User B divides token with id 2 of the same NFT. The nftToErc20Info[nftAddress] value is overwritten with data for ERC20 token for the token with id 2

After that, the data for ERC token for token 1 is lost and the NFT token is locked in the contract since no one can claim it. The reason that no one can claim it is that in function TokenDivider::claimNft the value from the mapping is used and it now contains data for token 2.

Impact

NFT token is locked in the contract.

Tools Used

Manual review

Recommendations

Store data for tokens for every token id in an NFT.