Submitted by Trust, also found by adriro
HolographERC721.sol#L467
HolographERC721.sol is an enforcer contract that fully implements ERC721. In its safeTransferFromFunction there is the following code:
If the target address is a contract, the enforcer requires the targets onERC721Received() to succeed. However, the call deviates from the standard:
The standard mandates that the first parameter will be the operator - the caller of safeTransferFrom. The enforcer passes instead the address(this) value, in other words the Holographer address. The impact is that any bookkeeping done in target contract, and allow / disallow decision of the transaction, is based on false information.
ERC721 transferFroms to contract may fail to accept transfers, or record credit of transfers incorrectly.
Pass the msg.sender parameter, as the ERC721 standard requires.
alexanderattar (Holograph) commented:
ACC01ADE (Holograph) linked a PR:
