reNFT - anshujalan's results

Lines of code

https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Guard.sol#L195-L294

Vulnerability details

Summary

• Several completely honest ERC721 & ERC1155 token contracts implement Openzeppelin's burnable interface that allows the owner of the NFT to burn it irreversibly.
  • ERC721Burnable: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/extensions/ERC721Burnable.sol
  • ERC1155Burnable: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC1155/extensions/ERC1155Burnable.sol
• Rented NFTs are held by the rental safes that guards all outbound transactions using the Guard policy.
• However, the Guard policy does not block calls to the burn function through the rental safes, thus allowing the renters to potentially the destroy a rented NFT held by their safe.
• Popular examples each of mainnet deployed ERC721 and ERC1155 contracts that have the burnable interface:
  • ERC721: https://etherscan.io/token/0xbd3531da5cf5857e7cfaa92426877b022e612cf8#code
  • ERC1155: https://etherscan.io/token/0x6811f2f20c42f42656a3c8623ad5e9461b83f719#code

Impact

• The lender loses their NFT irreversibly.
• The order can never be stopped since the internal NFT reclaim transaction always fails.

Proof of Concept

• Guard policy does not block ERC721::burn, ERC1155::burn and ERC1155::burnBatch: https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Guard.sol#L195-L293
• Reclaim fails when rental is stopped: https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Stop.sol#L293

Tools Used

Manual review

Recommended Mitigation Steps

Block transactions to the functions of the burnable interface using Guard policy: ERC721::burn, ERC1155::burn and ERC1155::burnBatch

Assessed type

Other