Summary

Malicious buyerAgent owner can airdropping the NFTs he need and avoid paying protocol listing fee. This can be happened because :

1. Owner of buyerAgent can list NFTs on their own buyerAgent

2. Price of NFT can be set = 0 to avoid paying listing protocol fee. This the formula for listing protocol fee :

Vulnerability Details

Schema

1. Malicious buyerAgent owner make buyerAgent with description :

   backstory : “Mr.WinTheContest in gardening life”

   objective : “Become number 1 successful gardener”

2. On sell phase, malicious buyerAgent owner list NFT with description “hoe” (or any relevant with his objective) to his own buyerAgent address with price of NFTs = 0 until reaches maximum value of assetsPerBuyerRound

3. On the buy phase, malicious buyerAgent buy all NFTs and get all NFTs according to the his objective

4. In this way, the protocol loses the protocol listing fee from the malicious buyerAgent owner (in other words the seller) and the malicious buyerAgent owner only pays the protocol fee when making a purchase to get NFTs according to his objective

Coded POC

create any test file and rename it —> copy this code —> run yarn test ‘path/test.test.ts’

Coded POC and result

Impact

The protocol loses the protocol listing fee and malicious buyerAgent easily get NFTs he need

Tools Used

Manual Review

Recommended Mitigation

Add check for msg.sender ≠ _buyer and price ≠ 0