Skip to content

Latest commit

 

History

History
20 lines (14 loc) · 865 Bytes

nft_approve_warning.md

File metadata and controls

20 lines (14 loc) · 865 Bytes

NFT Approve Warning

Configuration

  • Check: pess-nft-approve-warning
  • Severity: Medium
  • Confidence: Low

Description

The detector sees if a contract contains erc721.[safe]TransferFrom(from, ...) or erc1155.safe[Batch]TransferFrom(from, ...) where from parameter is not related to msg.sender. An attacker can steal any approved NFTs because transferFrom function does NOT check that the call is made by its owner.

Vulnerable Scenario

test scenario

Related attack

Unauthorized transfer_from Vulnerability

Recommendation

Make sure that in erc721.[safe]TransferFrom(from, ...) and erc1155.safe[Batch]TransferFrom(from, ...) functions from parameter is related to msg.sender.