Open hats-bug-reporter[bot] opened 2 months ago
What is the impact here?
isAttachedNFT
is not needed, since you can see that it checks whether the counterparty is the owner of this NFT, so only he can own it. The very concept of pulling a token from another strategy to attach it to another requires preparation, contract upgrades, etc. and is not provided by the existing functionality
Github username: -- Twitter username: -- Submission hash (on-chain): 0xd83ef350eea26feabc117f92110bc83d3aa3994e1c52a9bc42512f6f29c6b051 Severity: medium
Description: Description\ The
attachManagedNFT
function in theBaseManagedNFTStrategyUpgradeable
contract currently lacks a check to verify if the NFT is already attached to another managed token. This omission can lead to potential conflicts and unintended behavior, as the same NFT might be managed by multiple strategies simultaneously.The current implementation of the
attachManagedNFT
function checks if themanagedTokenId
is already set, verifies the validity of the NFT, and ensures that the contract owns the NFT. However, it does not check if the NFT is already attached to another managed token.Attack Scenario\ Describe how the vulnerability can be exploited.
Attachments
Proof of Concept (PoC) File
Revised Code File (Optional)