scammed - Approved users with approvedForAll cannot act over lsNFT

[sherlock-admin4]

scammed

Medium

Approved users with approvedForAll cannot act over lsNFT

Summary

NFT approved users with setApprovalForAll cannot act as a single approved user.

Vulnerability Detail

NFT can be approved in 2 ways, by approve and by setApprovalForAll. _requireOnlyApprovedOrOwnerOf should allow approved users to call privilege functions of lsNFT, but since NFT can only have one approved user with approve and multiple with setApprovalForAll, if the caller is approved with setApprovalForAll, he cannot act over NFT because the setApprovalForAll check is missing.

MlumStaking.sol#L148-L151

function _requireOnlyApprovedOrOwnerOf(uint256 tokenId) internal view {
    require(_ownerOf(tokenId) != address(0), "ERC721: operator query for nonexistent token");
    require(_isOwnerOf(msg.sender, tokenId) || getApproved(tokenId) == msg.sender, "FORBIDDEN");
}

Impact

A user who is approved with setApprovalForAll cannot call functions in MlumStaking.sol.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/MlumStaking.sol#L148-L151

Tool used

Manual Review

Recommendation

Change _requireOnlyApprovedOrOwnerOf to check for ERC721::isApprovedForAll as well, just like in ERC721::_isAuthorized.

Duplicate of #378