Papr contest - SmartSek's results

Lines of code

https://github.com/with-backed/papr/blob/9528f2711ff0c1522076b9f93fba13f88d5bd5e6/src/PaprController.sol#L98-L106

Vulnerability details

Impact

Even though it is used as an example in the "How it Works" section PUNKs are not currently supported.

Proof of Concept

CryptoPunks was created before the ERC721 standard and therefore, doesn't have a transferFrom function. CryptoPunks address: 0xb47e3cd837dDF8e4c57F05d70Ab865de6e193BBB

https://github.com/with-backed/papr/blob/9528f2711ff0c1522076b9f93fba13f88d5bd5e6/src/PaprController.sol#L98-L106

    function addCollateral(IPaprController.Collateral[] calldata collateralArr) external override {
        for (uint256 i = 0; i < collateralArr.length;) {
            _addCollateralToVault(msg.sender, collateralArr[i]);
            collateralArr[i].addr.transferFrom(msg.sender, address(this), collateralArr[i].id); //@audit unsafe NFT transfer
            unchecked {
                ++i;
            }
        }
    }

Recommended Mitigation Steps

Supporting CryptoPunks would require the implementation of specialised functions that handle the collection.