BUG: cw-ics721 attacked by malicious CW721 contract

[giansalex]

Summary of Bug

A cw721 contract containing malicious code added to TransferNft method, which would then be executed by ICS721 to redeem an NFT (on IBC Rcv).

Environment

• OS: Ubuntu 20.04.4
• Software version: [email protected]. [email protected]

Steps to Reproduce

• Customize cw721-base contract, add infinte loop code to transfer_nft handler.
• Upload code, Instantiate and mint an NFT
• Transfer NFT to IRIS network
• Return NFT to JUNO Network

Expected and Actual Behavior

Expected: ACK with error for exceeding the gas limit
Actual: Transaction on JUNO (IBC Recv) never completes

Additional Context

This can cause a DoS attack, where relayers are busy trying to execute transactions that cannot be completed.

Malicious cw721 contract
https://blueprints.juno.giansalex.dev/#/contracts/juno1rn6q7hdd95wly4tuun7ffjc4x2rak27twd6ypynlyplpc84um03qqvtq7h

[giansalex]

Also the malicious contract can send more packets when executed by cw-ics721, turning it into an endless loop of packets.

example: Juno <> Iris

Irisnet does not have a max gas per block configured.