Assessment reports>Maia DAO Ulysses Protocol>Threat Model>withdrawERC721

Function: withdrawERC721(address _token, uint256 _tokenId)

Transfers ownership of an ERC-721 token (NFT) from the virtual account to the sender. Can only be called by the approved caller.

Inputs

  • _token

    • Control: Full control.

    • Constraints: None, but it will revert if specifying a contract that does not implement ERC-721.

    • Impact: The address of the token contract to withdraw from.

  • _tokenId

    • Control: Full control.

    • Constraints: None, but it will revert if the token ID is not owned by the virtual account nor approved to transfer it.

    • Impact: The token ID to withdraw.

Branches and code coverage

Intended branches

  • Transfer NFT to the approved caller.

Negative behavior

  • Unapproved caller tries to claim NFT.

Zellic © 2024Back to top ↑