Submission Details
Severity:
use safetransfer and safetransferfrom instead of transfer
Summary
here we are using transfer and transferfrom instead of safetransferfrom and safetransfer .some token does not return or revert on failed transfer.
Vulnerability Details
function transferRoyalties(AssetListing storage asset) internal {
// calculate fees
uint256 buyerFee = (asset.price * asset.royaltyFee) / 100;
uint256 driaFee = (buyerFee * getCurrentMarketParameters().platformFee) / 100;
// first, Swan receives the entire fee from seller
// this allows only one approval from the seller's side
@> token.transferFrom(asset.seller, address(this), buyerFee);
// send the buyer's portion to them
@> token.transfer(asset.buyer, buyerFee - driaFee);
// then it sends the remaining to Swan owner
@> token.transfer(owner(), driaFee);
}
/// @notice Executes the purchase of a listing for a buyer for the given asset.
/// @dev Must be called by the buyer of the given asset.
function purchase(address _asset) external {
AssetListing storage listing = listings[_asset];
// asset must be listed to be purchased
if (listing.status != AssetStatus.Listed) {
revert InvalidStatus(listing.status, AssetStatus.Listed);
}
// can only the buyer can purchase the asset
if (listing.buyer != msg.sender) {
revert Unauthorized(msg.sender);
}
// update asset status to be sold
listing.status = AssetStatus.Sold;
// transfer asset from seller to Swan, and then from Swan to buyer
// this ensure that only approval to Swan is enough for the sellers
SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
SwanAsset(_asset).transferFrom(address(this), listing.buyer, 1);
// transfer money
@> token.transferFrom(listing.buyer, address(this), listing.price);
@> token.transfer(listing.seller, listing.price);
emit AssetSold(listing.seller, msg.sender, _asset, listing.price);
}
Impact
token will be lost due to this.transfer will be failed and tokens will get struck.
Tools Used
Recommendations
use safetransfer and transfer .
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
[KNOWN] - Low-35 Unsafe use of transfer()/transferFrom() with IERC20
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.