Using _transfer() instead of safeTransferFrom() may cause the user's NFT to be frozen in a contract that does not support ERC721

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/GovNFT.sol#L101
https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/BondNFT.sol#L336
https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/GovNFTBridged.sol#L79

Vulnerability details

Impact

The GovNFT/BondNFT/GovNFTBridged contract allows users to call safeTransferMany() to send nft to the to address, and safeTransferMany() bottom layer will call _transfer() to send nft, but here if the to address does not support ERC721. Then the nft will be locked in the to address.

Proof of Concept

    function _transfer(
        address from,
        address to,
        uint256 tokenId
    ) internal override {
        require(ownerOf(tokenId) == from, "!Owner");
        for (uint i=0; i<assetsLength(); i++) {
            userDebt[from][assets[i]] += accRewardsPerNFT[assets[i]];
            userDebt[from][assets[i]] -= userPaid[from][assets[i]]/balanceOf(from);
            userPaid[from][assets[i]] -= userPaid[from][assets[i]]/balanceOf(from);
            userPaid[to][assets[i]] += accRewardsPerNFT[assets[i]];
        }
        super._transfer(from, to, tokenId);//@audit
    }

Tools Used

vscode

Recommended Mitigation Steps

It is recommended to use safeTransferFrom() to send nft

[c4-judge]

GalloDaSballo marked the issue as duplicate of #356

[c4-judge]

GalloDaSballo marked the issue as satisfactory