highLogic errorEVM-Solidity
Superposition: Unrevoked approvals allow NFT recovery by previous owner
- Payout
- $0
- Protocol
- Superposition
- Disclosed
- Oct 18, 2024
- Source
- code4rena
A logic error in the NFT contract's transfer logic fails to clear per-token approvals (`getApproved[_tokenId] = address(0)`) when a token changes ownership. Consequently, previously approved operators or former owners retain valid transfer rights over the toke …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-08-superposition-findings/issues/160
- https://github.com/code-423n4/2024-08-superposition-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.