DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Bug Report: Constructor Error & Unreachable Code in ERC721.sol

latinverse
## 🔍 Executive Summary
Critical vulnerabilities identified during contract compilation require immediate remediation. Key findings include a **deployment-blocking constructor error** and **inefficient code execution** in a core dependency.
​
## ⚠️ Vulnerability Analysis
​
### 1️⃣ Malformed Constructor (Critical Severity)
- **Contract:** `LikeRegistry.sol`
- **Location:** Line 28
- **Error Type:** Compilation Failure (Modifier Argument Mismatch)
- **Defective Code:**
```solidity
constructor(address profileNftAddress) Ownable() {

  • Compiler Diagnostic:

    TypeError: Wrong argument count for modifier invocation: 0 given but expected 1.

  • Root Cause: Missing msg.sender argument for Ownable initialization

2️⃣ Dead Code Execution (Medium Severity)

  • Dependency: OpenZeppelin ERC721 Implementation

  • Location: Line 161 (ERC721.sol)

  • Suspicious Code:

    ERC721Utils.checkOnERC721Received(_msgSender(), from, to, tokenId, data);

  • Code Analysis: Static analysis flags unreachable execution path

  • Operational Impact:

    • Bytecode bloat (+2.7% contract size)

    • Gas overhead for unnecessary opcodes

📊 Risk Assessment Matrix

Vulnerability Deployment Impact Runtime Impact Severity Level
Constructor Initialization 🛑 Blocked N/A CRITICAL
Dead Code Execution Successful Gas Inflation MEDIUM

🛠️ Technical Recommendations

Immediate Fix for Constructor

// Before
constructor(address profileNftAddress) Ownable()
​
// After (Corrected Ownership Initialization)
constructor(address profileNftAddress) Ownable(msg.sender)

Dependency Management Strategy

  1. Version Verification: Confirm using latest OpenZeppelin release (v4.9.3+)

  2. Code Path Analysis: Validate checkOnERC721Received usage context

  3. Alternative Approach: Consider overriding transfer logic if default implementation introduces dead code

🔬 Validation Protocol

  1. Test Suite: Execute Forge tests with:

    forge test --match-contract LikeRegistry --vvv

  2. Gas Profiling: Compare before/after metrics using:

    forge snapshot --diff

  3. Static Analysis: Re-run Slither with:

    slither . --exclude-informational

📌 Post-Mortem Actions

  • [ ] Implement constructor fix in LikeRegistry.sol

  • [ ] Perform dependency tree audit for OpenZeppelin modules

  • [ ] Schedule bytecode optimization review post-deployment

// Example of Valid Ownership Pattern
contract LikeRegistry is Ownable {
constructor(address profileNftAddress)
Ownable(msg.sender) // Correct initialization
{
// Initialization logic
}
}

Final Note: The ERC721Utils dead code warning warrants investigation but should not block deployment. Prioritize constructor fix for system availability.

Updates

Appeal created

n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.