Submission Details
Severity:
Anyone can list assets for free
Summary
The function Swan::list and Swan::relist allows asset listing for 0 price.
Vulnerability Details
The functions Swan::list and Swan::relist are used by sellers to list assets to the buyer agent.
These functions lack input validation check which allows anyone to technically list assets for free.
Proof of Concept
Replace the function in the test/Swan.test.ts file at L167
it("should list 1 assets for the first round", async function () {
await listAssets(
swan,
buyerAgent,
[
[seller, parseEther("0")],
],
NAME,
SYMBOL,
DESC,
0n
);
});
Impact
Sellers will list anything for free and would not have to pay any royalty in return + no fees will be paid to the swan contract.
Tools Used
Manual Review + Hardhat
Recommendations
Consider implementing a minimum value validation
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
DOS the buyer / Lack of minimal amount of listing price
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.