ICS-721 Implementation (Golang)

CertiKFiles named in the report

CertiK reviewed IRIS Network (ICS-721 Implementation (Golang)) on 1 Nov 2023: 22 findings, 1 critical; 6 marked fixed, 1 acknowledged, 15 open.

1 open critical finding
Open the reportOpen IRIS Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings22

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical100
High100
Medium010
Low1306
MediumClass ID Could Be Incorrectly Parsed If It ContaiAcknowledged

Files: - `types/trace.go` Commits: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) - [`fa7bd3f3cb1ebe24f781953a781add96509b4c2a`](https://github.com/bianjieai/nft-transfer/tree/fa7bd3f3cb1ebe24f781953a781add96509b4c2a) The `rawClassID` is converted to class trace by splitting with the separator `/` in the function `ParseClassTrace()`, which creates a new string slice of `classSplit`. The `Path` and `BaseClassId` are determined by the position in the string slice. ```go=67 func ParseClassTrace(rawClassID string) ClassTrace { classSplit := strings.Split(rawClassID, "/") if classSplit[0] == rawClassID { return ClassTrace{ Path: "", BaseClassId: rawClassID, } } return ClassTrace{ Path: strings.Join(classSplit[:len(classSplit)-1], "/"), BaseClassId: classSplit[len(classSplit)-1], } } ``` It works fine if there is no "/" in the input, `rawClassID`. In case that the `rawClassID` contains "/", it could be an issue with this splitting method. For example, the following class trace parsing could occur: > e.g. "class-1/2" => ClassTrace{Path: "class-1", BaseClassId: "2"} which would impact the following usage of the class trace and lead to the collision of class trace afterwards. Note that there is no restriction in the ADR nft modules in [`ADR-043`](https://github.com/cosmos/cosmos-sdk/blob/main/docs/architecture/adr-043-nft-module.md#nft). Additionally, it should not restrict the classID with "/", because the `voucherClassID` could be constructed with prefix `ibc/` during the interchain NFT transfer. Then the voucher NFT will be minted in the upper level NFT modules. **Reference**: - https://github.com/cosmos/cosmos-sdk/blob/main/docs/architecture/adr-043-nft-module.md#nft

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (23)

  • types/keys.go
  • keeper/events.go
  • types/msgs.go
  • types/errors.go
  • keeper/genesis.go
  • module.go
  • keeper/msg_server.go
  • client/cli/query.go
  • types/trace.go
  • types/genesis.go
  • keeper/relay.go
  • keeper/keeper.go
  • types/params.go
  • types/events.go
  • types/packet.go
  • keeper/params.go
  • keeper/grpc_query.go
  • types/codec.go
  • client/cli/tx.go
  • types/expected_keeper.go
  • client/cli/cli.go
  • keeper/trace.go
  • ibc_module.go

Part of IRIS Network’s security record

IRIS Network
Audits2 audits by 1 firmLast audit Mar 2024, by CertiK.
Critical findings1 open critical findingReported in “ICS-721 Implementation (Golang)” by CertiK, Nov 2023. Not marked fixed in that report.
Open IRIS Network’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us