Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

User could prevent listing other assets, using zero fee assets

sovaslava

Summary

User could create many assets (up to the limit - maxAssetCount()), and prevent for listing of other assets from other users. It could be possible, because user could avoid payment of fee (which should deter such attacks).

Vulnerability Details

User could call function list() multiply times with price = 0, so user will not pay fee for listing. And he could create many assets (up to the limit) and other users could not list their assets for selected buyer for current round. And attacker will not pay fee for it

function list(string calldata _name, string calldata _symbol, bytes calldata _desc, uint256 _price, address _buyer)
external
{
...
listings[asset] = AssetListing({
createdAt: block.timestamp,
royaltyFee: buyer.royaltyFee(),
price: _price,
seller: msg.sender,
status: AssetStatus.Listed,
buyer: _buyer,
round: round
});
​
...
transferRoyalties(listings[asset]);
}
​
function transferRoyalties(AssetListing storage asset) internal {
// calculate fees
uint256 buyerFee = (asset.price * asset.royaltyFee) / 100; // 0 <----------
uint256 driaFee = (buyerFee * getCurrentMarketParameters().platformFee) / 100; // 0 <-
​
// first, Swan receives the entire fee from seller
// this allows only one approval from the seller's side
token.transferFrom(asset.seller, address(this), buyerFee); // 0 <----
​
// send the buyer's portion to them
token.transfer(asset.buyer, buyerFee - driaFee);
​
// then it sends the remaining to Swan owner
token.transfer(owner(), driaFee);
}

The same problem there is in relist function

Impact

The user will prevent other users from listing offers

Tools Used

Manual review

Recommendations

Create check for minimum price

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DOS the buyer / Lack of minimal amount of listing price

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.