Closed c4-bot-3 closed 3 months ago
Picodes marked the issue as primary issue
True, that's why we didn't put it on the compliance checklist
@dyedm1 so you're saying that it never was your intention to have full compliance to the standard?
Picodes changed the severity to QA (Quality Assurance)
Correct. The ERC1155 standard is a little too opinionated IMO
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/tokens/ERC1155Minimal.sol#L94-L120 https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/tokens/ERC1155Minimal.sol#L130-L171
Vulnerability details
Impact
SemiFungiblePositionManager/ERC1155Minimal is not fully EIP1155 compliant.
Bug Description
There are two behaviours that does not comply with EIP1155: https://eips.ethereum.org/EIPS/eip-1155.
During
safeBatchTransfer
andsafeBatchTransferFrom
, it does not revert if the recipient is zero address.During
safeBatchTransferFrom
, it does not revert if_ids
is not the same length as_values
.Quote from EIP1155:
Proof of Concept
See quote from EIP1155.
Tools Used
Manual review
Recommended Mitigation Steps
Add corresponding checks.
Assessed type
Other