First Flight #13: Baba Marta

Summary

As we want that only the producers can call this function, there is no restriction to anyone preventing from calling function listMartenitsaForSale

Vulnerability Details

Anyone can call this function. But, The function includes a require statement that checks if the caller is a producer. Since the caller in the test is not a producer, the require statement will cause the transaction to revert.

      @>   function listMartenitsaForSale(uint256 tokenId, uint256 price) external {
             require(
                msg.sender == martenitsaToken.ownerOf(tokenId),
             "You do not own this token"
              );
              require(
              martenitsaToken.isProducer(msg.sender),
             "You are not a producer!"
            );
            require(price > 0, "Price must be greater than zero");

           Listing memory newListing = Listing({
           tokenId: tokenId,
          seller: msg.sender,
           price: price,
                    design: martenitsaToken.getDesign(tokenId),
                    forSale: true
                });

                tokenIdToListing[tokenId] = newListing;
                emit MartenitsaListed(tokenId, msg.sender, price);
                }

Impact

Medium

PoC