Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nibbstack/erc721
master @ 26106bb
6
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
contracts/tokens/NFTokenEnumerable.sol: most-fixed (3 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The token burn process historically trusted a user-supplied owner address parameter instead of resolving ownership internally, enabling unauthorized token destruction. Ensure all burn and transfer pathways resolve the token owner directly from state.
Logic Error: Critical state-synchronization bugs during minting, burning, and removing tokens in the enumerable collection caused the token ID to index mappings (`idToIndex`) to fall out of sync with actual token arrays, leading to collection corruption.
Auth Bypass: Flawed return value assertions on ERC-721 receiver checks could allow safe token transfers to bypass recipient validation. Assertions must strictly enforce the correct magic receiver return bytes.