First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Producer Can List an NFT in `MartenitsaMarketplace` and Then Send it as a Present Without Removing It From Listing

4rdiii

[L-2] Producer Can List an NFT in MartenitsaMarketplace and Then Send it as a Present Without Removing It From Listing

Description: Producers can list their NFTs using the listMartenitsaForSale function and then, without removing it from the listings, send it to another user using the makePresent function.

Impact: This process does not remove the NFT from the listing but can lead to several issues:

  1. The buyMartenitsa function will always revert because the producer is no longer the owner of the NFT.

  2. The getListing function will return incorrect data, indicating that the NFT is still for sale when it has been transferred.

  3. Users can still vote for the NFT using the MartenitsaVoting::voteForMartenitsa function, and the producer will receive the HealthToken as if the NFT were still for sale.
    Note that this might be a design choice, as the getListing and buyMartenitsa functions will still not perform correctly in this case.
    Proof of Concept: The test below if added to the test suit can be used as proof of concept:

function testListThenPreseant() public createMartenitsa {
vm.startPrank(chasy);
marketplace.listMartenitsaForSale(0, 1 ether);
​
martenitsaToken.approve(address(marketplace), 0);
martenitsaToken.approve(address(bob), 0);
​
martenitsaToken.safeTransferFrom(chasy, bob, 0);
vm.stopPrank();
​
vm.prank(bob);
martenitsaToken.approve(address(marketplace), 0);
​
vm.deal(jack, 10 ether);
vm.prank(jack);
(list) = marketplace.getListing(0);
// getListing still returns true but buyMartenitsa is unusable
uint256 tokenId = list.tokenId;
assertEq(tokenId, 0);
vm.expectRevert();
marketplace.buyMartenitsa{value: 1 ether}(0);
}

Recommended Mitigation: Check for tokens being listed in makePresent function.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Listed MartenitsaToken can be transferred before the sale

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.