Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of Transfer Success Verification for NFT Transfer

adamszymanski

Summary

The contract does not verify the success of the NFT transfer to the contract in the start function.

Vulnerability Details

After calling erc721_dispatcher.transfer_from, there is no check to ensure the NFT was successfully transferred to the contract.

Code Reference:

// In start function
erc721_dispatcher.transfer_from(caller, receiver, self.nft_id.read().into());
// Missing verification of transfer success

Impact

The auction can commence without the NFT being held by the contract, potentially defrauding bidders who believe they are bidding on an NFT that the contract does not possess.

Recommendations

  • After the transfer call, verify the contract's ownership of the NFT.

  • Use safe transfer methods or handle exceptions to ensure the transfer was successful.

  • Revert the transaction if the NFT transfer fails.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.