The CallyNft contract does not override the transferFrom function, resulting in an underflow in the transferFrom function

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/CallyNft.sol#L12-L12

Vulnerability details

Impact

The CallyNft contract inherits from the ERC721 contract and removes the modification to _balanceOf to save gas.
The CallyNft contract overrides the _mint and _burn functions, but does not override the transferFrom function, which causes an underflow when the user calls the transferFrom and safeTransferFrom functions of the CallyNft contract

Proof of Concept

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/CallyNft.sol#L12-L12

Tools Used

None

Recommended Mitigation Steps

Override transferFrom function

    function transferFrom(
        address from,
        address to,
        uint256 id
    ) public virtual {
        require(from == _ownerOf[id], "WRONG_FROM");

        require(to != address(0), "INVALID_RECIPIENT");

        require(
            msg.sender == from || isApprovedForAll[from][msg.sender] || msg.sender == getApproved[id],
            "NOT_AUTHORIZED"
        );
        _ownerOf[id] = to;

        delete getApproved[id];

        emit Transfer(from, to, id);
    }

[itsmetechjay]

Withdrawn by warden cccz per help desk.