adminApprove will not work

[code423n4]

Handle

pauliax

Vulnerability details

Impact

function adminApprove intends to allow an admin to approve NFTs on behalf of users:

  function adminApprove(address newAddress, uint256 nft) external {
    require(_isProtocolAdmin(_msgSender()), ExceptionsLibrary.ADMIN);
    IERC721(address(this)).approve(newAddress, nft);
  }

However, when it calls .approve, it will check the ownership again, so only the calls from admin and owner/approved will pass: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/ERC721.sol#L116-L119

This makes this function ineffective.

Recommended Mitigation Steps

Based on my understanding, it should call ._approve(...).