Upgraded Q -> 2 from #112 [1693761181150]

Judge has assessed an item in Issue 112 as 2 risk. The relevant finding follows: If a profile gets blocked, the user can refollow by accepting a pre-upgrade followNFT and then using the batchMigrateFollows function. --- The text was updated successfully, but these errors were encountered: All...

profileIdAllowedToRecover is not handled properly in tryMigrate()

Lines of code Vulnerability details Impact In FollowNFT.sol, when calling tryMigrate, the state at the end should be the same when you call baseFollow and fresh follow the owner of the collection. However, profileIdAllowedToRecover is not handled inside of tryMigrate and it should be deleted as...

Cannot unwrap token after recovering through wrapping

Lines of code Vulnerability details Impact Cannot unwrap token after recovering through wrapping. Proof of Concept FollowNFTunwrap checks if followerProfileId for the token is not 0: if followDataByFollowTokenIdfollowTokenId.followerProfileId == 0 revert NotFollowing; while after recovering token...

Users can unfollow through FollowNFT contract when LensHub is paused by governance

Lines of code Vulnerability details Bug Description When the LensHub contract has been paused by governance state set to ProtocolState.Paused, users should not be able unfollow profiles. This can be inferred as the unfollow function has the whenNotPaused modifier: LensHub.solL368-L371 function...

The processBlock() function does the wrapping process wrongly

Lines of code Vulnerability details Impact The blocking process in the FollowNFT contract needs to wrap it first, but it does the wrapping process wrongly. wrapping process in wrap function update some statement and then mint token but if you look at processBlock function, it's just mint token an...

Possible integer underflow

Lines of code Vulnerability details Impact The previous FollowNFT implementation is different between v1.3 and v2.0. The followerCount is 0 for existing FollowNFTeven if lastFollowTokenId is not 0 after upgrade. // Old uint256 lastFollowTokenId slot splitted into two uint128s to include...

FollowNFT storage collision

Lines of code Vulnerability details Impact The lastFollowTokenId of FollowNFT contract has a storage collision. V2.0 storage layout: | lastFollowTokenId | uint128 | 17 | 0 | 16 | contracts/FollowNFT.sol:FollowNFT | | followerCount | uint128 | 17 | 16 | 16 | contracts/FollowNFT.sol:FollowNFT |...

The FollowNFT.initialize() function will never be executed

Lines of code Vulnerability details Impact This function Initializes the follow NFT. To check if a function has already been initialized use: if initialized revert Errors.Initialized; This condition will always end with revert Errors.Initialized, because in the constructor, when expanding the...

tryMigrate() has onlyHub modifier but it's called from LensV2Migration

Lines of code Vulnerability details Impact In FollowNFT.sol, tryMigrate function has onlyHub modifier as other functions that are supposed to be called by LensHub such as follow and unfollow. These functions are called via delegatecall and LensHub is preserved as msg.sender. The problem is that t...

Function initialize Not Work

Lines of code Vulnerability details Impact As mentioned in the comment of the function initialize, "This is called right after deployment by the LensHub, so we can skip the onlyHub check". However, when the contract FollowNFT is deployed, the state variable initialized is set to true in the...

Unrestricted Access to setRoyalty Function

Lines of code Vulnerability details Impact Severity: High Likelihood: High Description The setRoyalty function in the ERC2981CollectionRoyalties contract can be called by anyone. This function is used to set the royalty information for a specific token ID. However, because there are no access...