Submission Details
Severity:
Missing Token Approval Check in transferRoyalties Function
Summary
The transferRoyalties function in the Swan contract attempts to transfer tokens from the seller without first checking or requiring approval, leading to failed transactions and potential inconsistent state.
Vulnerability Details
The transferRoyalties function attempts to transfer tokens without verifying approval:
function transferRoyalties(AssetListing storage asset) internal {
// calculate fees
uint256 buyerFee = (asset.price * asset.royaltyFee) / 100;
uint256 driaFee = (buyerFee * getCurrentMarketParameters().platformFee) / 100;
// Attempts transfer without checking approval
token.transferFrom(asset.seller, address(this), buyerFee); // Will revert if not approved
// send the buyer's portion to them
token.transfer(asset.buyer, buyerFee - driaFee);
// then it sends the remaining to Swan owner
token.transfer(owner(), driaFee);
}
This function is called in both list and relist functions:
Impact
Asset listing process fails
No way to determine required approval beforehand
Poor user experience with failed transactions
Tools Used
Manual Review
Recommendations
Add approval check before transfer:
function transferRoyalties(AssetListing storage asset) internal {
uint256 buyerFee = (asset.price * asset.royaltyFee) / 100;
uint256 driaFee = (buyerFee * getCurrentMarketParameters().platformFee) / 100;
// Check approval before transfer
uint256 allowance = token.allowance(asset.seller, address(this));
if (allowance < buyerFee) {
revert InsufficientAllowance(allowance, buyerFee);
}
// Transfer with approval verified
token.transferFrom(asset.seller, address(this), buyerFee);
token.transfer(asset.buyer, buyerFee - driaFee);
token.transfer(owner(), driaFee);
}
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.