Wildanzrrr wildanzrrr

In order to steals Alice NFT on the Game contract, there's some way to do that:

Using Fake Attacker NFT

Step to reproduce:

This method will need Bob to deploy his own NFT (fake) and mint an NFT with the same id that Alice deposited to the Game contract.
Then, Bob will transfer his NFT to the Game contract. This action will rewrite the mapping tokenId 10 to Bob's address.
Next, Bob will call withdraw function on the Game contract. This action will success because the validation doing check by comparing originalOwner[tokenId] == msg.sender

	// Import required dependencies
	const express = require("express");
	const multer = require("multer");
	const path = require("path");
	const fs = require("fs");

	// Specifies the file upload location
	const diskStorage = multer.diskStorage({
	destination: (req, file, cb) => {
	cb(null, path.join(__dirname, "uploads"));
	},
	filename: (req, file, cb) => {
	cb(
	null,
	`${file.fieldname}-${Date.now()}${path.extname(file.originalname)}`
	);

	const acceptedFileTypes = [
	"image/jpeg",
	"image/png",
	"image/svg+xml",
	"video/mp4",
	"video/quicktime",
	"video/webm",
	"application/pdf",
	"application/msword",
	"application/vnd.openxmlformats-officedocument.wordprocessingml.document",

	// Create an express app
	const PORT = 5000; // Best practice use environment variable
	const HOST = "http://localhost"; // Best practice use environment variable
	const app = express();
	app.use(express.json());

	app.post("/uploads", upload.single("file"), (req, res) => {
	const file = req.file;

	if (!file) {

	// import required dependencies
	import dotenv from 'dotenv';
	import nodemailer from 'nodemailer';
	import { google } from 'googleapis';
	const OAuth2 = google.auth.OAuth2;

	// init dotenv
	dotenv.config();

	// get environment variables

	// create OAuth2 client
	const oauth2Client = new OAuth2(
	OAUTH_CLIENT_ID,
	OAUTH_CLIENT_SECRET,
	'https://developers.google.com/oauthplayground'
	);

	// set refresh token
	oauth2Client.setCredentials({
	refresh_token: OAUTH_REFRESH_TOKEN

	// create reusable transporter object using the default SMTP transport
	const transporter = nodemailer.createTransport({
	service: 'gmail',
	auth: {
	type: 'OAuth2',
	user: OAUTH_EMAIL,
	clientId: OAUTH_CLIENT_ID,
	clientSecret: OAUTH_CLIENT_SECRET,
	refreshToken: OAUTH_REFRESH_TOKEN,
	accessToken: accessToken.toString()