Summary and Vulnerability Details

There is no check in purchase(address) function to ensure that buying of items is taking place only in the Buy phase. It is understood that this function may not be used for purchasing but it should noted that this is not protected and could be exploited by purchasing directly through the Swan contract.

Impact

Buyers can purchase items in any phase they want instead of making an exact time frame for the buying to take place.

Tools Used

Manual review

Recommendations

Add a check to Swan contracts purchase(address) function that ensures buyer is in Buy phase when purchasing listed items with the same kind of check like in list or relist.