Submission Details
Severity:
Swan.sol does not implement necessary interface to handle Nfts
Summary
Swan contract supposed to receive and transfer the assets(ntfs), however it does not support necessary interface
Vulnerability Details
The purchase function in Swan contract is defined as:
function purchase(address _asset) external {
//SNIP
// transfer asset from seller to Swan, and then from Swan to buyer
// this ensure that only approval to Swan is enough for the sellers
SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
SwanAsset(_asset).transferFrom(address(this), listing.buyer, 1);
// transfer money
token.transferFrom(listing.buyer, address(this), listing.price);
token.transfer(listing.seller, listing.price);
emit AssetSold(listing.seller, msg.sender, _asset, listing.price);
}
The function transfer the asset from seller to swan contract and later to buyer. However the contract does not implement ERC721TokenReceiver nor
onERC721Received function.
Ref:https://eips.ethereum.org/EIPS/eip-721
Impact
The contract will not able to handle the Nfts
Tools Used
Manual Review
Recommendations
Implement the necessary interface and functions
Updates
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420
USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.