# NFTs can be stolen by calling send() and receiving the nfts in another chain Crit/High · Three Sigma · Omnichain RWA tokenisation · 27th January, 2024 Finding 3S-MetaZero-C01 of the MetaZero Omnichain NFTs security review. - Protocol: https://metazero.gg/ - Report: /reports/metazero-i - Source: https://cdn.sanity.io/files/qoqld077/production/1b1ab4ff365756fe1d86767f1e06744407570f5a.pdf --- ### Description [send()](https://github.com/threesigmaxyz/metazero-issues-external/blob/master/src/ONFTV2-721C.sol#L98) does not check the owner of the to be sent nfts, which allows anyone to send nfts to itself on behalf of someone else. See the POC [here](https://github.com/threesigmaxyz/metazero-issues-external/blob/master/test/test.t.sol#L68). ### Recommendation Add _isApprovedOrOwner() on the nfts to be sent in send(). ### Status Addressed in f34458d. --- Related findings: - [TOFT in (m)TapiocaOft contracts can be stolen by calling removeCollateral() with a malicious removeParams.market](https://0xsimao.com/findings/tapioca-dao-toft-stolen-collateral-params): Tapioca DAO - [triggerSendFrom() will send all the ETH in the destination chain where sendFrom() is called to the refundAddress in the LzCallParams argument](https://0xsimao.com/findings/tapioca-dao-eth-refund-params-argument): Tapioca DAO