Submission Details
Severity:
A Martenitsa token listed for sale can be made as a present
Summary
A Martenitsa token listed for sale can be made as a present.
Vulnerability Details
In MartenitsaMarketplace.sol, A malicious actor can:
list a token for sale.
make the same token as a present for another user.
The token can be bought from the new owner including by the malicious actor himself.
Impact
Token sale without the owner consent.
Tools Used
Manual review.
Recommendations
Consider adding logic to prevent a gifted token from being listed for sale without the new owner's consent.
Updates
Lead Judging Commences
bube over 1 year ago
Submission Judgement Published Assigned finding tags:
Listed MartenitsaToken can be transferred before the sale
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.