code-423n4 / 2022-04-backed-findings

1 stars 1 forks source link

Using `transferFrom` on ERC721 tokens transfer #98

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L124

Vulnerability details

Impact

In the function closeLoan of contract NFTLoanFacilitator, collateral ERC721 token is sent to sendCollateralTo, the transferFrom keyword is used instead of safeTransferFrom. If any sendCollateralTo is a contract and is not aware of incoming ERC721 tokens, the sent tokens could be locked.

Proof of Concept

https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L124

Recommended Mitigation Steps

Consider changing transferFrom to safeTransferFrom.

wilsoncusack commented 2 years ago

83

gzeoneth commented 2 years ago

Duplicate of #83