Summary

The vulnerability occurs in the divideNft function because it only checks that the NFT owner is no longer the original owner after the safeTransferFrom call. However, it does not verify whether the NFT was successfully transferred to the contract itself. A malicious NFT contract could override the safeTransferFrom function to transfer ownership of the NFT to an unintended recipient, allowing for exploitation.

Vulnerability Details

The above logic ensures that the ownership of the NFT is changed from the original owner (msg.sender). However, it does not verify that the TokenDivider contract is the new owner of the NFT. This allows malicious contracts to exploit the vulnerability by transferring ownership to an unintended address while still passing the current check.

Impact

Attackers can repeatedly exploit this vulnerability to mint unbacked tokens and potentially sell them, leading to financial losses for the system and its users.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, explicitly check that the TokenDivider contract becomes the owner of the NFT after the safeTransferFrom call:

This ensures the NFT is successfully transferred to the contract and prevents exploitation by malicious contracts.