First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Users cannot cancel existing listings

robertodf99

Summary

Users can list their martenitsa tokens by calling MartenitsaMarketplace::listMartenitsaForSale, however once listed they cannot remove the listing.

Vulnerability Details

The only way for users not willing to sell their tokens will be to set the price to a extremely high value so that no one is able to pay for them.

Impact

The intended functionality of the the field forSale within the struct MartenitsaMarketplace::Listing is invalidated in the current contract design as this value can never be set to false.

Tools Used

Foundry and manual review.

Recommendations

Add a function which allows to cancel the listing:

function cancelListing(uint256 tokenId) public {
require(
(tokenIdToListing[tokenId].seller == msg.sender) &&
(tokenIdToListing[tokenId].forSale == true),
"You do not own this NFT or it is not listed for sale"
);
​
tokenIdToListing[tokenId].forSale = false;
tokenIdToListing[tokenId].price = 0;
}

Note that the price is set to 0 as well to make the process more efficient and get a gas refund by freeing up some memory space.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.