OxTushar - No Validation of NFT Ownership or veAERO Validity in the Deposit Function of Receipt-veNFT Contract

[sherlock-admin2]

OxTushar

High

No Validation of NFT Ownership or veAERO Validity in the Deposit Function of Receipt-veNFT Contract

Summary

The deposit function in the Receipt-veNFT contract lacks proper validation to ensure that the NFT being deposited is owned by the user or corresponds to a valid veAERO.
https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/Non-Fungible-Receipts/veNFTS/Aerodrome/Receipt-veNFT.sol#L63

This oversight allows malicious users to deposit any random NFT, bypassing the intended logic of the protocol.

Root Cause

The deposit function does not verify whether the caller owns the NFT being deposited or whether the NFT is a valid veAERO. Without this check, users can deposit unrelated or invalid NFTs, potentially leading to protocol abuse or incorrect collateral calculations.

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/Non-Fungible-Receipts/veNFTS/Aerodrome/Receipt-veNFT.sol#L63

1. No Ownership Validation:
   • The contract does not check if msg.sender is the actual owner of tokenId before calling transferFrom.
2. No veAERO Validity Check:
   • The function does not verify if the tokenId corresponds to a valid veAERO.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Malicious users can deposit invalid NFTs, bypassing the requirement for legitimate assets.
This may lead to the issuance of rewards, incentives, or benefits based on fraudulent deposits.

PoC

No response

Mitigation

Verify that the tokenId belongs to the valid set of veAERO NFTs
Before calling transferFrom, ensure the caller owns the tokenId: