Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ERC20 Token Balance Manipulation Through Direct Transfers

0x180db

Summary

The ERC20ToGenerateNftFraccion contract allows ERC20 tokens representing NFT fractions to be transferred directly outside of the transferErcTokens function, which can lead to balance tracking issues and potential NFT locking.

Vulnerability Details

The contract maintains an internal balance tracking system through the balances mapping, but does not prevent direct ERC20 token transfers. Users can bypass the transferErcTokens function and transfer tokens directly using the ERC20 transfer methods.

Impact

  • Permanent locking of NFTs due to tokens being sent to unrecoverable addresses

  • Incorrect balance tracking leading to broken contract functionality

  • Inability to claim NFTs back even with legitimate ownership

  • Loss of user funds and assets

Tools Used

  • Manual code review

  • Performing formal verification with Quint

Recommendations

  1. Implement transfer restrictions on the ERC20 token contract:

function _update(address from, address to, uint256 amount) internal virtual override {
require(msg.sender == address(tokenDivider), "Only TokenDivider can transfer");
...
}
Updates

Lead Judging Commences

fishy Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Transfer ERC20ToGenerateNftFraccion separately to the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.