_transferNFTs checks if an item is ERC721 or ERC1155 by using IERC165(item.collection).supportsInterface(...).
function _transferNFTs(
address from,
address to,
OrderTypes.OrderItem calldata item
) internal {
if (IERC165(item.collection).supportsInterface(0x80ac58cd)) {
_transferERC721s(from, to, item);
} else if (IERC165(item.collection).supportsInterface(0xd9b67a26)) {
_transferERC1155s(from, to, item);
}
}
The issue is that if an item is neither of that, the function doesn't revert. Basically the execution continues as if an item was transferred.
If an user mistakenly used a wrong address, or if the NFT is something weird, someone will end up paying for buying nothing.
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L1062-L1072
Vulnerability details
Impact
_transferNFTs
checks if an item is ERC721 or ERC1155 by usingIERC165(item.collection).supportsInterface(...)
.The issue is that if an item is neither of that, the function doesn't revert. Basically the execution continues as if an item was transferred. If an user mistakenly used a wrong address, or if the NFT is something weird, someone will end up paying for buying nothing.
Proof of Concept
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L1062-L1072
Recommended Mitigation Steps
Add a
else
with a revert statement.