Submission Details
Severity:
Reallocating with the ERC20 address per NFT while dividing it
Summary
When the users are dividing to same NFT address, without checking the exist NFT address, so balances, nftToErc20Info variable is initiated every time
Vulnerability Details
In the divideNft() function, there is not checking part for existing NFT address.
So the nftToErc20Info ' ERC20 address is replaced with new address.
function divideNft(address nftAddress, uint256 tokenId, uint256 amount) onlyNftOwner(nftAddress, tokenId) onlyNftOwner(nftAddress ,tokenId) external {
if(nftAddress == address(0)) { revert TokenDivider__NftAddressIsZero(); }
if(amount == 0) { revert TokenDivider__AmountCantBeZero(); }
ERC20ToGenerateNftFraccion erc20Contract = new ERC20ToGenerateNftFraccion(
string(abi.encodePacked(ERC721(nftAddress).name(), "Fraccion")),
string(abi.encodePacked("F", ERC721(nftAddress).symbol())));
erc20Contract.mint(address(this), amount);
address erc20 = address(erc20Contract);
IERC721(nftAddress).safeTransferFrom(msg.sender, address(this), tokenId, "");
if(IERC721(nftAddress).ownerOf(tokenId) == msg.sender) { revert TokenDivider__NftTransferFailed(); }
balances[msg.sender][erc20] = amount;
// No checking existed NFT address
nftToErc20Info[nftAddress] = ERC20Info({erc20Address: erc20, tokenId: tokenId});
erc20ToMintedAmount[erc20] = amount;
erc20ToNft[erc20] = nftAddress;
emit NftDivided(nftAddress, amount, erc20);
bool transferSuccess = IERC20(erc20).transfer(msg.sender, amount);
if(!transferSuccess) {
revert TokenDivider__TransferFailed();
}
}
Impact
Prev User who divided the same NFT address cannot claim his NFT permanantly.
Tools Used
Foundry
Manual code review
Recommendations
You should update the type of nftToErc20Info variable to
mapping(address nft => mapping(uint256 tokenID => address erc20Address));
Updates
Lead Judging Commences
fishy 5 months ago
Submission Judgement Published Assigned finding tags:
Wrong nft collection handling
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.