Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Locked NFTs from Accidental Direct Transfers

empyrean

Locked NFTs from Accidental Direct Transfers

Description

  • NFTs transfer to marketplace only via listNFT with owner approval and verification.

  • Direct transfers (e.g., safeTransferFrom to contract address) succeed without hooks, locking NFTs indefinitely as no recovery mechanism exists.

contract BidBeastsNFTMarket is Ownable(msg.sender) {
// No onERC721Received implemented
@>// Direct NFT transfer locks asset@>
}

Risk

Likelihood:

  • User errors sending NFTs to contract address instead of owner.

  • Malicious transfers targeting marketplace.

Impact:

  • Permanent NFT loss for sender.

  • Contract bloat, potential denial of inventory management.

Proof of Concept

Mints NFT to seller, transfers directly to market (succeeds), asserts market owns it and not listed to show stuck NFT.

function testLockedNFTFromDirectTransfer() public {
_mintNFT(); // Token 0 to SELLER
​
// Direct transfer to market (succeeds, no revert)
vm.prank(SELLER);
nft.transferFrom(SELLER, address(market), TOKEN_ID);
​
// Market owns but cannot transfer out (no function)
assertEq(nft.ownerOf(TOKEN_ID), address(market));
​
// Check if listed (should not be)
BidBeastsNFTMarket.Listing memory listing = market.getListing(TOKEN_ID);
assertFalse(listing.listed, "NFT should not be listed");
}

Recommended Mitigation

Adds revert hook for direct transfers; or owner recovery function to send NFT back.

+// Implement ERC721 receiver hook to revert direct transfers
+function onERC721Received(
+ address,
+ address from,
+ uint256,
+ bytes calldata
+) external pure override returns (bytes4) {
+ revert("Direct NFT transfers not allowed");
+}
​
// Or add owner-only recovery
+function recoverNFT(uint256 tokenId, address to) external onlyOwner {
+ BBERC721.transferFrom(address(this), to, tokenId);
+}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Risk of Locked NFTs

Non-safe transferFrom calls can send NFTs to non-compliant contracts, potentially locking them permanently.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.