Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of validation for `_price` parameter in list and `relist` functions lead to revenue loss, impact platform economics, and facilitate market manipulation in `Swan.sol`

safdie

Summary

The Swan contract’s list and relist functions lack validation for the _price parameter, allowing users to set extremely low or high prices without restriction. This issue lead to unintended consequences, such as abuse of the platform for creating assets with zero or negligible price or artificially inflating prices. Without validation, this flexibility lead to revenue loss, impact platform economics, and potentially facilitate market manipulation.

Vulnerability Details

The list and relist functions in the Swan contract allow sellers to specify the _price of an asset. However, there are no validations in place to restrict the value of _price. This lack of validation allows malicious users to:

  1. List assets with a zero or negligible price, which may encourage spam listings or abuse of assets, potentially impacting the perceived legitimacy of the platform.

  2. Set excessive prices that exceed reasonable limits, which can contribute to asset value manipulation and discourage legitimate buyers.

To prevent these potential issues, it is essential to enforce minimum and maximum price bounds within the list and relist functions.

The vulnerable code is shown below, where no checks are implemented on _price:

function list(string calldata _name, string calldata _symbol, bytes calldata _desc, uint256 _price, address _buyer)
external
{
// ...other checks omitted
​
// Vulnerable code: No validation on `_price`
address asset = address(swanAssetFactory.deploy(_name, _symbol, _desc, msg.sender));
listings[asset] = AssetListing({
createdAt: block.timestamp,
royaltyFee: buyer.royaltyFee(),
price: _price,
seller: msg.sender,
status: AssetStatus.Listed,
buyer: _buyer,
round: round
});
​
emit AssetListed(msg.sender, asset, _price);
}
​
function relist(address _asset, address _buyer, uint256 _price) external {
// Only the seller can relist the asset
AssetListing storage asset = listings[_asset];
if (asset.seller != msg.sender) {
revert Unauthorized(msg.sender);
}
​
// Vulnerable code: No validation on `_price`
listings[_asset].price = _price;
emit AssetRelisted(msg.sender, _buyer, _asset, _price);
}

A malicious user can exploit the lack of _price validation by setting extremely low or high values.

Steps:

  • Deploy the Swan contract and initialize it.

  • Call the list or relist function with _price set to 0 or an extremely high value.

  • Observe that there is no validation preventing such extreme values.
    The following Hardhat test demonstrates the lack of _price validation:

const { ethers } = require("hardhat");
const { expect } = require("chai");
​
describe("Swan _price Validation", function () {
let swan, buyerAgent;
let owner, user;
​
before(async function () {
const Swan = await ethers.getContractFactory("Swan");
swan = await Swan.deploy();
await swan.initialize(/* parameters */);
​
const BuyerAgent = await ethers.getContractFactory("BuyerAgent");
buyerAgent = await BuyerAgent.deploy(/* parameters */);
​
[owner, user] = await ethers.getSigners();
});
​
it("Should allow listing with zero or excessive price", async function () {
// Listing with zero price
await expect(
swan.connect(user).list("TestAsset", "TST", "Test Description", 0, buyerAgent.address)
).not.to.be.reverted;
​
// Listing with extremely high price
const highPrice = ethers.utils.parseEther("1000000"); // 1,000,000 ETH
await expect(
swan.connect(user).list("HighAsset", "HGT", "High Price Asset", highPrice, buyerAgent.address)
).not.to.be.reverted;
});
});

Running this test demonstrates that listing assets with a price of 0 or with an excessively high value (e.g., 1,000,000 ETH) is permitted. This confirms the lack of validation on the _price parameter.

Impact

Allowing arbitrary pricing values without validation can negatively impact the platform in several ways:

  • Spam Listings: Zero-priced assets could lead to spam listings, degrading the marketplace's quality.

  • Market Manipulation: Excessive prices can inflate or manipulate asset values, discouraging legitimate buyers and impacting the marketplace's credibility.

  • Revenue Loss: Listings with negligible prices might bypass intended economic mechanisms, resulting in potential revenue losses.

Tools Used

Manual review.

Recommendations

Introduce minimum and maximum bounds for _price in the list and relist functions. For example, ensure _price is greater than zero and less than a reasonable upper limit.

Example:

uint256 constant MIN_PRICE = 0.01 ether;
uint256 constant MAX_PRICE = 1000 ether;
​
require(_price >= MIN_PRICE && _price <= MAX_PRICE, "Invalid price: must be within allowed bounds");
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DOS the buyer / Lack of minimal amount of listing price

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.