From 08db1de9289908abd3e9598d0b52d6607d46a632 Mon Sep 17 00:00:00 2001
From: tequ <git@tequ.dev>
Date: Fri, 20 Feb 2026 03:33:34 +0900
Subject: [PATCH] Fix the flag processing of NFTokenModify (#5246)

Adds checks for invalid flags.
---
 include/xrpl/protocol/TxFlags.h           |  2 +-
 src/test/app/NFToken_test.cpp             | 20 +++++++++++++++++++-
 src/xrpld/app/tx/detail/NFTokenModify.cpp |  3 +++
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/include/xrpl/protocol/TxFlags.h b/include/xrpl/protocol/TxFlags.h
index 069e4454c..cb6634dae 100644
--- a/include/xrpl/protocol/TxFlags.h
+++ b/include/xrpl/protocol/TxFlags.h
@@ -218,7 +218,7 @@ constexpr std::uint32_t const tfNFTokenCreateOfferMask =
     ~(tfUniversal | tfSellNFToken);
 
 // NFTokenCancelOffer flags:
-constexpr std::uint32_t const tfNFTokenCancelOfferMask     = ~(tfUniversal);
+constexpr std::uint32_t const tfNFTokenCancelOfferMask     = ~tfUniversal;
 
 // NFTokenAcceptOffer flags:
 constexpr std::uint32_t const tfNFTokenAcceptOfferMask     = ~tfUniversal;
diff --git a/src/test/app/NFToken_test.cpp b/src/test/app/NFToken_test.cpp
index 6bea511f1..569d5b45a 100644
--- a/src/test/app/NFToken_test.cpp
+++ b/src/test/app/NFToken_test.cpp
@@ -7801,12 +7801,17 @@ class NFTokenBaseUtil_test : public beast::unit_test::suite
             env(token::mint(issuer, 0u), txflags(tfMutable));
             env.close();
 
-            // Set a negative fee.  Exercises invalid preflight1.
+            // Set a negative fee. Exercises invalid preflight1.
             env(token::modify(issuer, nftId),
                 fee(STAmount(10ull, true)),
                 ter(temBAD_FEE));
             env.close();
 
+            // Invalid Flags
+            env(token::modify(issuer, nftId),
+                txflags(0x00000001),
+                ter(temINVALID_FLAG));
+
             // Invalid Owner
             env(token::modify(issuer, nftId),
                 token::owner(issuer),
@@ -7876,6 +7881,19 @@ class NFTokenBaseUtil_test : public beast::unit_test::suite
             env.fund(XRP(10000), issuer, alice, bob);
             env.close();
 
+            // modify with tfFullyCanonicalSig should success
+            uint256 const nftId{token::getNextID(env, issuer, 0u, tfMutable)};
+            env(token::mint(issuer, 0u), txflags(tfMutable), token::uri("uri"));
+            env.close();
+
+            env(token::modify(issuer, nftId), txflags(tfFullyCanonicalSig));
+            env.close();
+        }
+        {
+            Env env{*this, features};
+            env.fund(XRP(10000), issuer, alice, bob);
+            env.close();
+
             // lambda that returns the JSON form of NFTokens held by acct
             auto accountNFTs = [&env](Account const& acct) {
                 Json::Value params;
diff --git a/src/xrpld/app/tx/detail/NFTokenModify.cpp b/src/xrpld/app/tx/detail/NFTokenModify.cpp
index 74ca1baef..7e616ea6c 100644
--- a/src/xrpld/app/tx/detail/NFTokenModify.cpp
+++ b/src/xrpld/app/tx/detail/NFTokenModify.cpp
@@ -37,6 +37,9 @@ NFTokenModify::preflight(PreflightContext const& ctx)
     if (NotTEC const ret = preflight1(ctx); !isTesSuccess(ret))
         return ret;
 
+    if (ctx.tx.getFlags() & tfUniversalMask)
+        return temINVALID_FLAG;
+
     if (auto owner = ctx.tx[~sfOwner]; owner == ctx.tx[sfAccount])
         return temMALFORMED;