Wrong amount of ERC1155 token result in loss of funds for buyer

Lines of code Vulnerability details Impact In StandardPolicyERC1155 contract, the amount of ERC1155 token always return 1 instead of amount value in Order struct. The result is when ERC1155 orders is matched, buyers will only receive 1 token even they specify amount 1, which means loss of funds f...

ERC1155's Amount Parameter Manipulation To Steal Buyers' Funds

Lines of code Vulnerability details Vulnerability Details We discovered that a rogue seller i.e., attacker can place an order for selling N amount where N 1 of a specific token id of an ERC-1155 NFT collection. However, when the sell order is fulfilled by a buyer, the attacker would spend only 1...

The amount of an ERC1155 token should be checked.

Lines of code Vulnerability details Impact For NFT token of type ERC1155, there may be multiple tokens with the same tokenId. Therefore, when processing orders of type ERC1155, it is necessary to check not only whether the tokenId of the NFT for both buyers and sellers are matched, but also the...

execute does not work for ERC1155 tokens orders where amount > 1

Lines of code Vulnerability details Impact StandardPolicyERC1155 functions canMatchMakerBid and canMatchMakerBid always return amount == 1, regardless of the function arguments. This means that calling execute on an agreed order of ERC1155 token with an amount 1 will always transfer amount == 1 o...

Re-entrancy risk to Project in ArtGobblers.gobble()

Lines of code Vulnerability details Impact In ArtGobblers.gobble, the function accepts user controlled input which may create re-entrancy opportunity in the ERC1155.safeTransferFrom and ERC721.transferFrom external calls . Since the nft parameter is user-controlled, any user can create a maliciou...

Some real-world NFT tokens may support both ERC721 and ERC1155 standards, which may break gobble ()

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

Use safeTransferFrom for ERC721 too

Lines of code Vulnerability details Impact safeTransferFrom is used for ERC1155 but not for ERC721 in gooble Proof of Concept function gobble uint256 gobblerId, address nft, uint256 id, bool isERC1155 external ..........................snip................................. isERC1155 ?...

ERC1155.isApprovedForAll(owner, receiver) logic means it is possible for an approved receiver to withdraw more shares than expected

Lines of code Vulnerability details In the Readme, it is mentioned a receiver can call withdraw on behalf of the shares owner we accept deposits and withdraws on behalf of other users, by using approve ERC1155 functions on withdraw, and recipient/owner params inside both deposit/withdraw function...

Malicious party active member can approve malicious contract to spend and steal party ERC1155 nft and ERC20 tokens via arbitrary proposal execution

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Let's look into the implementation in ArbitraryCallsProposal.sol // Check that the call is not prohibited. if !isCallAllowedcall, isUnanimous, preciousTokens, preciousTokenIds revert...

Miscalculated payout to NFT sellers completing ERC1155 bids

Lines of code Vulnerability details Impact Payout to user fulfilling bid orders by selling their NFTs on ERC1155 will get incorrectly calculated. This will lead to eth getting stuck in the contract, and users not getting their advertised payout. Proof of Concept This whole bug takes place in...

It is possible to create fake ERC1155 NameWrapper token for subdomain, which is not owned by NameWrapper

Lines of code Vulnerability details Impact Due to re-entrancy possibility in NameWrapper.transferAndBurnFuses called from setSubnodeOwner and setSubnodeRecord, it is possible to do some stuff in onERC1155Received right after transfer but before new owner and new fuses are set. This makes it...

ERC1155 support unchecked - NFT can be lost

Lines of code Vulnerability details Impact It is not checked whether withdrawn token supports ERC1155 interface. Also there is no check to see if necessary approval have been set for sending nft The fix need to be applied for all other functions withdrawing ERC1155 Proof of Concept 1. Observe the...

Malicious code in opensea-erc1155 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57ed9708d2415ab3223ea55143304ce5afb9087aba7a655afdc96d9ad56c5102 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5099 Malicious code in opensea-erc1155 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57ed9708d2415ab3223ea55143304ce5afb9087aba7a655afdc96d9ad56c5102 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

_transferNFTs doesn't revert for bad tokens

Lines of code Vulnerability details Impact transferNFTs checks if an item is ERC721 or ERC1155 by using IERC165item.collection.supportsInterface.... function transferNFTs address from, address to, OrderTypes.OrderItem calldata item internal if IERC165item.collection.supportsInterface0x80ac58cd...

_transferNFTs() functions doesn't reverts if the transfer item doesn't supports interface for both ERC721 and ERC1155

Lines of code Vulnerability details Impact The transferNFTs function use ERC165 to check if the itemnft supports ERC721 interface or ERC1155 interface and execute transfer accordingly. But if it doesn't supports either, it just exits the functionno revert. Proof of Concept in...

Multiple items order can be matched to many same items order

Lines of code Vulnerability details Impact Let's consider an example. Alice makes an order for an ERC1155, where she wants to buy 10 items with id=1 and 10 with id=2. This order can be matched using matchOneToManyOrders with two orders that sell both 10 items with id=1. Basically Alice gets 20 id...

wfCashERC4626.sol#redeem() Lack of slippage control for market sell

Lines of code Vulnerability details function redeem uint256 shares, address receiver, address owner public override returns uint256 // It is more accurate and gas efficient to check the balance of the // receiver here than rely on the previewRedeem method. uint256 balanceBefore =...

deposit through onERC1155Received can be locked by attackers, making the function useless

Lines of code Vulnerability details Impact Disable depositing through onERC1155Receive, potentially breaking all integrations using this function as entry point. Proof of concept An attacker can transfer another fCash position to the wrapper contract, which will trigger ERC1155Actions.transfer ⇒...

_transfer#Executor.sol not checking all enum values

Lines of code Vulnerability details Impact Transaction can revert or have unexpected behaviour Poc In transferexecutor.sol you are checking Itemtype values Itemtype.NATIVE, Itemtype.ERC20 and Itemtype.ERC721 after then the last else clause assumes that the Itemtype is a ERC1155. else @audit assum...