Submission Details
Severity:
Arbitrary `from` passed to `transferFrom` in `Swan.sol`
Summary
Passing an arbitrary from address to transferFrom can lead to loss of funds, because anyone can transfer tokens from the from address if an approval is made.
Vulnerability Details
3 Found Instances
```javascript
function purchase(address _asset) external {
//////////////////////////////////////////
/////////////////////////////////////////
=> SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
=> SwanAsset(_asset).transferFrom(address(this), listing.buyer, 1);
=> token.transferFrom(listing.buyer, address(this), listing.price);
}
```
```javascript
function transferRoyalties(AssetListing storage asset) internal {
//////////////////////////////////////////////
=> token.transferFrom(asset.seller, address(this), buyerFee);
}
```
Impact
loss of assets from the contract to .
Tools Used
manual review
Recommendations
use (msg.sender) in the from field while calling
transferFrom
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.