LSP8CompatibleERC721InitAbstract._checkOnERC721Received return value is incorrect

Lines of code Vulnerability details Impact Can be transferred to EOA through safeTransferFrom Proof of Concept problematic code call path safeTransferFrom-safeTransfer-checkOnERC721Received safeTransferFrom annotate / @inheritdoc ILSP8CompatibleERC721 @dev Compatible with ERC721 safeTransferFrom...

ERC721 onERC721Received() reentrancy

Lines of code Vulnerability details Impact Reentrancy is an attack that can occur when a bug in a contract may allow a malicious contract to reenter the contract unexpectedly during execution of the original function. This can be used to drain funds from a smart contract if used maliciously...

Using transferFrom on ERC721 tokens transfer

Lines of code Vulnerability details Impact The transferFrom method is used instead of safeTransferFrom which is not recommended. It can result in loss of NFT if the address is not able to handle the received NFT. OpenZeppelin’s documentation discourages the use of transferFrom, use safeTransferFr...

ERC721 tokens can be forever locked when transferring

Lines of code Vulnerability details Impact An action that transfers ERC721 tokens from the account contract to another contract could result in the ERC721 tokens being locked forever if the receiving contract doesn't support receiving ERC721 tokens. Proof of Concept The LlamaAccount contract uses...

Manually assigning token IDs in ERC-721 can cause problems in the future

Lines of code Vulnerability details Impact 1. It can lead to duplicate token IDs. If two different people manually assign the same token ID to their tokens, this can create a conflict. This can lead to problems when trying to transfer or sell the tokens, as the recipient may not be able to claim...

Attacker can steal CrossDomainMessenger and OptimismPortal token balances or tokens of anyone give approval for those contracts

Lines of code Vulnerability details Impact Contracts CrossDomainMessenger and OptimismPortal are part of the bridge protocol and they are responsible for sending messages between two network. they both call arbitrary address with arbitrary data that user specified and it would give attacker to...

Upgraded Q -> 2 from #245 [1683017351880]

Judge has assessed an item in Issue 245 as 2 risk. The relevant finding follows: L-05 PrivatePoolMetadata.tokenURI is not compliant with EIP721 It implements PrivatePoolMetadata.tokenURI , a function overriding ERC721's tokenURI. This function returns the metadata URI of the provided token ID The...

External calls can be manipulated

Lines of code Vulnerability details Impact By making external calls to untrusted contracts, the sender might manipulate the contract's state and cause unintended behavior. Proof of Concept In the tokenURI and mint functions, the contract makes external calls to ERC721nftContract.tokenURInftID and...

Ticket: Owner of winning ticket can frontrun secondary sales

Lines of code Vulnerability details The Wenwin docs note that tickets "can be traded on the secondary market before or after the draw," since they are standard ERC721 tokens. After a ticket draw, the owner of a winning ticket may call LotteryclaimWinningTickets, which transfers lottery winnings t...

CVE-2023-26488

OpenZeppelin Contracts ERC721Consecutive has a balance-update bug for batches of size 1, causing balanceOf to overflow. Root cause: balances not updated after mint/batch transfers. Impact is partial (balance overflow risk) and fixes were applied in version 4.8.2; update to 4.8.2 or later to remed...

PT-2023-20679 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.8.2 Description: The ERC721Consecutive contract, designed for minting NFTs in batches, does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the...

Upgraded Q -> 2 from #19 [1677669238372]

Judge has assessed an item in Issue 19 as 2 risk. The relevant finding follows: KUMABondToken.sol KBT-01L: Potential Approval Blacklist Bypass Affected Lines: L148 The KUMABondToken::approve function will apply a blacklist check on the to as well as msg.sender contextual arguments of the call,...

KUMABondToken.approve() should revert if the owner of the tokenId is blacklisted

Lines of code Vulnerability details Impact It is still possible for a blacklisted user's bond token to be approved. Proof of Concept KUMABondToken.approve only checks if msg.sender and to are not blacklisted. It doesn't check if the owner of the tokenId is not blacklisted. For example, the...

Upgraded Q -> 2 from #619 [1675724616184]

Judge has assessed an item in Issue 619 as 2 risk. The relevant finding follows: L-06 In contract Quest the function claim shouldn't only set the receipt as claimed, but to burn it as well. As this problem brings the risk, where users can sell already claimed receipts to other people The function...

Multiple people can register the same cidNFTID

Lines of code Vulnerability details Impact Multiple people can register the same cidNFT in a way that the same "canonical on-chain identity" can be shared accross multiple real-life identities. Proof of Concept cidNFTs can be transfered as any ERC721 token. After each transfer the new owner can...

BURN any ERC721 tokens in DRIFT NFT protocol by just sending the tokenID on the public burn function

Lines of code Vulnerability details Impact Access control plays an important role in segregation of privileges in smart contracts and other applications. If this is misconfigured or not properly validated on sensitive functions, it may lead to loss of funds, tokens, and in some cases, compromise ...

CidNFT: Broken tokenURI function

Lines of code Vulnerability details CidNFTtokenURI does not convert the uint256 id argument to a string before interpolating it in the token URI: /// @notice Get the token URI for the provided ID /// @param id ID to retrieve the URI for /// @return tokenURI The URI of the queried token path to a...

ERC721 safeTransferFrom is not enough to safeguard a subprotocol NFT

Lines of code Vulnerability details Proof of Concept There is a safeguard mechanism to ensure that no transfers of the subprotocol NFT happen after said NFT is tied to the CID NFT. Without it, someone could transfer or even burn the subprotocol NFT while it is still associated. // The CID Protoco...

Unchecked External Call Vulnerability in ownerOf Function Call.

Lines of code Vulnerability details Impact In the worst-case scenario, if the ownerOf function call reverts due to a security vulnerability in the ERC721 contract, the caller's data could be manipulated, and their funds could be at risk. This could lead to a loss of funds for users who have...

ONLYMINTER MODIFIER WILL NOT REVERT WHEN MSG.SENDER IS NOT MINTERADDRESS

Lines of code Vulnerability details Impact onlyMinter in RabbitHoleReceipt.sol and RabbitHoleTickets.sol is noted to be housing only msg.sender == minterAddress in its code logic. RabbitHoleReceipt.solL58-L61 RabbitHoleTickets.solL47-L50 modifier onlyMinter msg.sender == minterAddress; ; It will...