Submission Details
Severity:
```Streets::stake``` anyone can stake NFT of other users
Summary
The Streets::stake exhibits the absence of ownership verification. This oversight allows any user to initiate the staking process for any NFT, provided they have been granted transfer approval, without verifying if the caller is the legitimate owner of the NFT.
Vulnerability Details
@> function stake(uint256 tokenId) external {
stakes[tokenId] = Stake(block.timestamp, msg.sender);
emit Staked(msg.sender, tokenId, block.timestamp);
oneShotContract.transferFrom(msg.sender, address(this), tokenId);
}
Impact
The absence of ownership verification in the staking process lead to unauthorized staking actions. Individuals other than the NFT owner can stake NFTs without the owner's consent (if they have been granted a transfer approval before).
Tools Used
Manual review
Recommendations
Implement the ownership verification in the stake function.
Updates
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.