Incorrect authority check in NFToken.transferFrom - Githubissues

zerolawtech / ZAP-Tech

ZeroLaw Augmentation Protocol

GNU General Public License v3.0

27 stars 13 forks source link

Incorrect authority check in NFToken.transferFrom #18

Closed iamdefinitelyahuman closed 4 years ago

iamdefinitelyahuman commented 5 years ago

The Issue

In NFToken.transferFrom, _auth is set but not properly passed to _transfer:

https://github.com/iamdefinitelyahuman/ZAP-Tech/blob/62f8434e9033a930f61e3ddb968a5ecd227ef535/contracts/NFToken.sol#L565-L571

When the issuer uses transferFrom, this results in improper permission checks as well as incorrect modification of the allowed mapping.

How to Fix

Correctly pass _auth to _transfer
Write additional tests that check for correct behavior when transferFrom is called by the issuer