Sweep n Flip Bridge — Permanent failure to bridge wrapped ERC721

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 46493-permanent-failure-to-bridge-wrapped-erc721-using-bridgesende. Standalone Foundry PoC and full write-up: 46493-permanent-failure-to-bridge-wrapped-erc721-using-bridgesende_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/dos/frozen-funds · locked-funds · bridge-message-validation · royalty-edge-cases

Reproduction: self-contained Foundry PoC, offline, forge-std only. Full trace: output.txt. PoC: test/46493-permanent-failure-to-bridge-wrapped-erc721-using-bridgesende_exp.sol.

Key info#


Impact	HIGH — original NFT permanently locked; wrap cannot reverse-bridge
Protocol	Sweep n Flip Bridge
Vulnerable code	`Bridge._getPayload` / `_getPayloadMessage` — metadata from origin when bridging wrap
Bug class	Wrong metadata source for wrapped ERC721 → send always reverts on dest
Finding	Cantina — Sweep n Flip Bridge, Nov 2024 · #46493 · reporter slowfi
Report	cantina_sweepnflip_bridge_november2024.pdf
Source	AuditVault
Status	Audit finding — fixed in snf-bridge-contracts-v1 PR 10
Compiler	`^0.8.24` (PoC)

TL;DR#

Bridging an origin NFT locks it on the source bridge and mints a wrap on the destination.
Reverse-bridging the wrap must read metadata from the wrap (which exists on dest).
The bug binds IERC721Metadata to the origin address, which has no code on dest.
sendERC721UsingNative always reverts on the wrap path → original NFT stays locked forever.

The vulnerable code#

SOLIDITY

address originERC721Address =
    w.originAddress == address(0) ? ERC721Address_ : w.originAddress;
IERC721Metadata metadata = IERC721Metadata(originERC721Address); // @> VULN
metadata.name();
metadata.tokenURI(tokenIds_[i]);

Fix: use currChainAddress_ (the wrap when bridging a wrap) for metadata.

Root cause#

Payload construction confuses origin vs current-chain addresses. Metadata must come from the contract that exists on the current chain.

Preconditions#

User successfully bridged origin → wrap (origin locked on source).
User attempts wrap → origin reverse bridge on the destination chain.
Origin collection address is codeless on the destination.

Attack walkthrough#

Origin NFT locked in source bridge; wrap minted to user on dest.
User calls sendERC721UsingNative(originChain, wrap, [id]).
_getPayload queries tokenURI on the codeless origin address → revert.
HARM: wrap unredeemable; origin permanently locked in source bridge.

Diagrams#

flowchart TD A["User holds wrap on dest"] --> B["sendERC721UsingNative wrap"] B --> C{"Metadata source"} C -->|"BUG: origin address"| D["codeless on dest → revert"] C -->|"FIX: wrap address"| E["tokenURI succeeds"] D --> F["Origin NFT locked forever"] E --> G["Reverse bridge completes"]

Impact#

Permanent lock of original NFTs in the source bridge whenever users try to bridge wraps home.

Sources#

AuditVault finding #46493
Cantina report — Sweep n Flip Bridge (Nov 2024)
Reduced C2 synthetic from finding-quoted getPayload / getPayloadMessage fix diff

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 46493-permanent-failure-to-bridge-wrapped-erc721-using-bridgesende_exp (evm-hack-registry mirror).
AuditVault finding: 46493-permanent-failure-to-bridge-wrapped-erc721-using-bridgesende.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync