First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Arithmetic underflow when calling `MartenitsaMarketplace.sol::buyMartenitsa`

coffee

Summary

If a producer list's their token and then gives it as a present MartenitsaMarketplace.sol::makePresent then that token is attempted to be bought, it can revert with an arithmetic underflow error.

Vulnerability Details

If a producer creates 1 MartenitsaToken, the MartenitsaToken.sol::countMartenitsaTokensOwner mapping will be 1. Then if they list it for sale MartenitsaMarketplace.sol::listMartenitsaForSale and give it as a gift, MartenitsaMarketplace.sol::makePresent the countMartenitsaTokensOwner mapping will be 0. If someone goes to buy the token, the countMartenitsaTokensOwner mapping for the producer would be -1 and it would revert. This means nobody could ever buy that Token.

Impact

This test reverts with an arithmetic underflow error showing that the MartenitsaToken.sol::countMartenitsaTokensOwner mapping for the producer can become negative one.

function testUnderflowBuyAfterGiftingToken() public {
vm.startPrank(chasy);
martenitsaToken.createMartenitsa("bracelet");
marketplace.listMartenitsaForSale(0, 1 wei);
martenitsaToken.approve(address(marketplace), 0);
marketplace.makePresent(bob, 0);
vm.stopPrank();
​
vm.startPrank(jack);
vm.expectRevert();
marketplace.buyMartenitsa{value: 1 wei}(0);
vm.stopPrank();
}

Tools Used

--Foundry

Recommendations

It is recommended to cancel any current listings of a MartenitsaToken if it is being given as a present.

function makePresent(address presentReceiver, uint256 tokenId) external {
require(msg.sender == martenitsaToken.ownerOf(tokenId), "You do not own this token");
martenitsaToken.updateCountMartenitsaTokensOwner(presentReceiver, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(msg.sender, "sub");
+ delete tokenIdToListing[tokenId];
martenitsaToken.safeTransferFrom(msg.sender, presentReceiver, tokenId);
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Listed MartenitsaToken can be transferred before the sale

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.