Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

User can prevent the purchase of other assets if they have been selected by the oracle

sovaslava

Summary

If oracle return list of assets, which should be purchased, and among them there is attacker's asset, attacker could prevent purchasing of all assets, which were selected by oracle, thereby harming other users.

Vulnerability Details

Function BuyerAgent.sol.purchase() decode oracle result and output is array of asset address's. Next, there is for loop, in which calling swan.purchase(asset). In swan.purchase() occurs transfer asset(nft) from sellet to buyer. The problem is that if one purchase will fail, all purchases will fail to - tx completly fail. One unsuccessful purchase entails the impossibility of making all other purchases.

function purchase() external onlyAuthorized {
...
bytes memory output = oracleResult(taskId);
address[] memory assets = abi.decode(output, (address[]));
​
// we purchase each asset returned
for (uint256 i = 0; i < assets.length; i++) {
address asset = assets[i];
...
​
// make the actual purchase
swan.purchase(asset); // <------ if its failed, all loop will fail
}

Bad sellet(attacker) could transfer nft(id 1 in asset contract) to any other address in his Asset contract, so transfer nft from seller to Swan contract will fail.

Swan.sol

function purchase(address _asset) external {
...
​
// transfer asset from seller to Swan, and then from Swan to buyer
// this ensure that only approval to Swan is enough for the sellers
SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
// @audit this transfer will fail, if sellet transfer nft from asset
// contract to any other address

Impact

Attacker could prevent other purchases in loop

Tools Used

Manual review

Recommendations

Add try/catch block in for loop

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

DoS in BuyerAgent::purchase

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!