Dria

Summary

In the current implementation, when an asset is relisted for a new buyer, it's added to the new buyer's assetsPerBuyerRound mapping but it's never removed from the old buyer's mapping.

Vulnerability Details

relisting adds to the assetsPerBuyerRound but does not remove it from the previous buyer's array.

    assetsPerBuyerRound[_buyer][round].push(_asset);

• When an asset is first listed, it's added to assetsPerBuyerRound[buyer][round]

• When it's relisted:

• It should be removed from assetsPerBuyerRound[oldBuyer][oldRound]

• Then added to assetsPerBuyerRound[newBuyer][newRound]

However it is not being removed

Impact

For now I believe the impact is not high, but it does fill up the array and might lead to a potential revert

Tools Used

Code review

Recommendations

Remove the listing from the previous buyer 's assetsPerBuyerRound