Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Function claimNft of TokenDivider.sol doesn't resets NFT to ERC20 mapping.

oldmonk0003

Summary

A user can claim NFT using Function claimNft of TokenDivider.sol. However, after the NFT is claimed the mapping nftToErc20Info is still pointing to Erc20 Address and the token id. It should be reset.

Vulnerability Details

Step 1 - Mint few NFTs for user.

Step 2 - User Locks NFT and get ERC tokens

Step 3 - User claims NFTs

Step 4 - Call public function getErc20InfoFromNft. Notice that it still is mapped to the erc20Address
and token id. claimNft must clear this mapping.

public function getErc20InfoFromNft gives an impression that NFT is still tied to ERC20 Address and token id. However that is not true.

function testThatClaimNFTDoesntRemoveMappingBerweenNFTandERC20() public {
// Step 1 - Mint few NFTs for user.
erc721Mock.mint(USER);
erc721Mock.mint(USER);
​
uint256 TokenId = 1;
​
vm.startPrank(USER);
​
// Step 2 - User Locks NFT and get ERC tokens
erc721Mock.approve(address(tokenDivider), TokenId);
​
tokenDivider.divideNft(address(erc721Mock), TokenId, AMOUNT);
​
// Step 3 - User claims NFTs
​
ERC20Mock erc20Mock = ERC20Mock(
tokenDivider.getErc20InfoFromNft(address(erc721Mock)).erc20Address
);
​
erc20Mock.approve(address(tokenDivider), AMOUNT);
tokenDivider.claimNft(address(erc721Mock));
​
// Step 4 - Call public function getErc20InfoFromNft. Notice that it still is mapped to the erc20Address
// and token id. claimNft must clear this mapping.
console.log("ERC20 Address Still Tied to NFT is -");
console.logAddress(
tokenDivider.getErc20InfoFromNft(address(erc721Mock)).erc20Address
);
​
console.log("Token Id still tied to NFT is -");
console.log(
tokenDivider.getErc20InfoFromNft(address(erc721Mock)).tokenId
);
​
vm.stopPrank();
}

Impact

Storage variable doesnt reflect the transaction.

Tools Used

Foundry. Manual Inspection.

Recommendations

Reset mapping nftToErc20Info in claimNft just like other storage variables are reset.

Updates

Lead Judging Commences

fishy Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.