First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

If a MartenitsaToken is listed on the marketplace and then transfered to someone else, it can be voted on and if it win's then the rewards will not go to the current owner

coffee

Summary

If a MartenitsaToken is listed on the marketplace MartenitsaMarketplace.sol::listMartenitsaForSale and then transferred to someone else MartenitsaMarketplace.sol::makePresent, the listing persists. The token can then be voted on MartenitsaVoting.sol::voteForMartenitsa and if it win's, the rewards will not go to the current owner of the token.

If the new owner of the token is not a producer there will also be no way for them to stop the token from being bought or to end the listing.

Vulnerability Details

If a MartenitsaToken is listed on the marketplace and then transferred; it can be voted on and the listing owner is already set as the previous owner. If the token wins the vote, then the HealthToken prize will go to the previous owner who created the listing and not the current owner.

Impact

The test below passes showing that the previous owner of the token gets the reward and not the current owner. Because the new owner is not a producer, they have no way of overriding the listing to become the listing owner.

function testListTokenTransferAndVoteForIt() public {
vm.startPrank(chasy);
martenitsaToken.createMartenitsa("bracelet");
marketplace.listMartenitsaForSale(0, 1 wei);
martenitsaToken.approve(address(marketplace), 0);
marketplace.makePresent(bob, 0);
vm.stopPrank();
​
vm.prank(bob);
voting.voteForMartenitsa(0);
vm.warp(block.timestamp + 1 days + 1);
vm.recordLogs();
voting.announceWinner();
​
Vm.Log[] memory entries = vm.getRecordedLogs();
address winner = address(uint160(uint256(entries[0].topics[2])));
​
assert(winner == chasy);
assert(healthToken.balanceOf(chasy) == 10 ** 18);
assert(healthToken.balanceOf(bob) == 0);
}

Tools Used

--Foundry

Recommendations

It is recommended to cancel any current listings of a MartenitsaToken if it is being given as a present.

function makePresent(address presentReceiver, uint256 tokenId) external {
require(msg.sender == martenitsaToken.ownerOf(tokenId), "You do not own this token");
martenitsaToken.updateCountMartenitsaTokensOwner(presentReceiver, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(msg.sender, "sub");
+ delete tokenIdToListing[tokenId];
martenitsaToken.safeTransferFrom(msg.sender, presentReceiver, tokenId);
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Listed MartenitsaToken can be transferred before the sale

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.