Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Bid function uses transfer instead of transfer_from

olugbenga

Summary

The bid function wrongly uses the transfer function instead of transfer_fromto transfer users bid

Vulnerability Details

In the bid function implementation, transferring ERC20 tokens from a user was done with transfer instead of transfer_from

fn bid(ref self: ContractState, amount: u64) {
....
erc20_dispatcher.transfer(receiver, amount.into());
}
​

Impact

If the contract has enough tokens, tokens will be transferred to the bidder from the contract instead of transferring from the bidder or the transaction will fail if the contract otherwise.

Tools Used

Manual

Recommendations

Replace transfer with transfer_from

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

olugbenga Submitter
9 months ago
bube Lead Judge
9 months ago
bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`transfer` instead of `transfer_from`

In the `bid` function is wrongly used `transfer` function instead `transfer_from`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.