The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Honeypotting users when selling Smart Vault NFTs is possible

matejdb

Summary

When selling Smart Vaults NFTs, which is an intended protocol design decision (see _afterTokenTransfer function in SmartVaultManager), malicious users can honeypot buyers by draining the vault before selling it.

Vulnerability Details

Smart Vault NFTs are expected to be sold on secondary NFT markets.
Attack scenario:

  1. Malicious seller lists Smart Vault on NFT market.

  2. Buyer sends a transaction that is expected to buy the vault and transfer it to him.

  3. Malicious seller sees this transaction in the mempool and sends a transaction to the Smart Vault contract to drain it -> mint maximum amount of EUROs.

  4. Buyer now ends up with an almost unusable vault.

Impact

Users lose funds they paid for Smart Vaults.

Tools Used

Manual review

Recommendations

Re-think the design decision of selling Smart Vault NFTs

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

matejdb Submitter
over 1 year ago
hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

nft-sale

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.