Using the transferfrom feature of the ERC721 contract may freeze the user's NFT

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/TokenTransferrer.sol#L22

Vulnerability details

Impact

When sending an NFT using the transferFrom function of the ERC721 contract, you can freeze the NFT in the contract if the receiving address is a smart contract and does not support ERC721.

Proof of Concept

	// contracts/TokenTransferrer.sol
    function _transferTokenToRecipient(
        CollectionType collectionType,
        address recipient,
        address collection,
        uint256 tokenId,
        uint256 amount
    ) internal {
        if (collectionType == CollectionType.ERC721) {
            IERC721(collection).transferFrom(address(this), recipient, tokenId); //@audit  
        } else if (collectionType == CollectionType.ERC1155) {
            IERC1155(collection).safeTransferFrom(address(this), recipient, tokenId, amount, "");
        }
    }

Tools Used

vscode

Recommended Mitigation Steps

Send the NFT using the 'safeTransferFrom' function of the ERC721 contract.

[c4-judge]

Picodes marked the issue as duplicate of #174

[c4-judge]

Picodes marked the issue as not a duplicate

[c4-judge]

Picodes changed the severity to QA (Quality Assurance)

[c4-judge]

Picodes marked the issue as grade-b