Submission Details
Severity:
Missing Validation for tokenId in divideNft Function
Summary
The divideNft function does not validate whether the provided tokenId is valid or exists within the specified nftAddress and also if not zero. This omission can lead to unexpected errors, unintended behavior, and potential exploitation if invalid or malicious tokenId values are passed to the function.
Vulnerability Details
function divideNft(address nftAddress, uint256 tokenId, uint256 amount) onlyNftOwner(nftAddress, tokenId) external {
if (nftAddress == address(0)) {
revert TokenDivider__NftAddressIsZero();
}
if (amount == 0) {
revert TokenDivider__AmountCantBeZero();
}
// No validation for the tokenId
}
Impact
An attacker could pass malicious or invalid
tokenIdvalues to exploit the lack of validation, leading to potential denial of service or misuse of the function.
Tools Used
Manual
Recommendations
add the tokenId validation Missing Validation for tokenId in divideNft Function
if (!ERC721(nftAddress).ownerOf(tokenId)) {
revert TokenDivider__InvalidTokenId();
}
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.