Submitted by PwnedNoMore
Many real-world NFT tokens may support both ERC721 and ERC1155 standards, which may break InfinityExchange::_transferNFTs, i.e., transferring less tokens than expected.
For example, the asset token of The Sandbox Game, a Top20 ERC1155 token on Etherscan, supports both ERC1155 and ERC721 interfaces. Specifically, any ERC721 token transfer is regarded as an ERC1155 token transfer with only one item transferred (token address and implementation).
Assuming there is a user tries to buy two tokens of Sandboxs ASSETs with the same token id, the actual transferring is carried by InfinityExchange::_transferNFTs which first checks ERC721 interface supports and then ERC1155.
The code will go into _transferERC721s instead of _transferERC1155s, since the Sandboxs ASSETs also support ERC721 interface. Then,
Since the ERC721(item.collection).safeTransferFrom is treated as an ERC1155 transferring with one item (reference), there is only one item actually gets traferred.
That means, the user, who barely know the implementation details of his NFTs, will pay the money for two items but just got one.
Note that the situation of combining ERC721 and ERC1155 is prevalent and poses a great vulnerability of the exchange contract.
Check the return values of Sandboxs ASSETss supportInterface, both supportInterface(0x80ac58cd) and supportInterface(0xd9b67a26) return true.
Reorder the checks,e.g.,
nneverlander (Infinity) confirmed and resolved:
HardlyDifficult commented:
