OwnershipNFTs contract fais to reset approvals on token transfer

[c4-bot-1]

Lines of code

https://github.com/code-423n4/2024-08-superposition/blob/main/pkg/sol/OwnershipNFTs.sol#L109-L116

Vulnerability details

Impact

When a token is transferred to a new owner, its approval for another address is not revoked, potentially allowing the previous owner or approved party to transfer the token again, resulting in the loss of the token for the new owner.

Proof of Concept

The token owner can approve a specified tokenId to another address, giving that address the ability to manage the token:

    function approve(address _approved, uint256 _tokenId) external payable {
        _requireAuthorised(msg.sender, _tokenId);
>>      getApproved[_tokenId] = _approved;
    }

However, after the token is transferred to another address, the getApproved mapping is not cleared. This allows the previously approved address to continue having control over the token, enabling it to transfer the token away from its new owner.

Tools Used

Manual review

Recommended Mitigation Steps

    function _transfer(
        address _from,
        address _to,
        uint256 _tokenId
    ) internal {
        _requireAuthorised(_from, _tokenId);
        SEAWATER.transferPositionEEC7A3CD(_tokenId, _from, _to);
+       delete getApproved[_tokenId];
    }

Assessed type

ERC721

[c4-judge]

alex-ppg marked the issue as satisfactory