Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unchecked Return Values in Swan.sol::purchase Function

shahid

Summary

The purchase function performs several token and asset transfers using the transferFrom and transfer functions. These functions return a boolean value indicating success or failure. However the current implementation does not check these return values potentially leading to situations where transfers fail silently, causing inconsistencies in asset and fund states.

Vulnerability Details

SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
SwanAsset(_asset).transferFrom(address(this), listing.buyer, 1);
​
//transfer money
token.transferFrom(listing.buyer, address(this), listing.price);
token.transfer(listing.seller, listing.price);

Impact

  • Silent Failures: Transfers may fail without notice, leading to unexpected outcomes.

  • Inconsistent State: The contract state can become mismatched (e.g, asset marked sold without receiving payment).

  • Asset/Fund Locking: Funds or assets may become inaccessible if transfers don't complete successfully

Tools Used

  • Manual code review

Recommendations

(bool success) = SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
require(success, "transfer from seller to contract failed");
​
// Transfer asset from contract to buyer
(bool success2) = SwanAsset(_asset).transferFrom(address(this), listing.buyer, 1);
require(success2, "transfer to buyer failed");
​
// Transfer funds from buyer to contract (escrow)
(bool success3) = token.transferFrom(listing.buyer, address(this), listing.price);
require(success3, "payment failed");
​
// Transfer funds from contract to seller
(bool success4) = token.transfer(listing.seller, listing.price);
require(success4, "payment failed");
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[KNOWN] - Low-35 Unsafe use of transfer()/transferFrom() with IERC20

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.