Submission Details
Severity:
Asset purchase could be processed even if buyerAgent round is greater than asset was listed
Summary
Buyer agent could purchase for asset, even if his round is not queal to round, when asset has been listed.
Vulnerability Details
Functoin Swan.sol.purchase() dont check current round of buyer agent against round, when asset has been listed. And call to purchase() will be success and dont depends on round of buyer agent.
Impact
Problem is that each new round user (owner of asset) should call relist(), but he could not do it. And could not pay royalties.
Tools Used
Manual review
Recommendations
function purchase(address _asset) external {
AssetListing storage listing = listings[_asset];
+ (uint round, , ) = BuyerAgent(listing.buyer).getRoundPhase();
+ if(round != listing.round) { revert IvalidRound(); }
// asset must be listed to be purchased
if (listing.status != AssetStatus.Listed) {
revert InvalidStatus(listing.status, AssetStatus.Listed);
}
// can only the buyer can purchase the asset
if (listing.buyer != msg.sender) {
revert Unauthorized(msg.sender);
}
// update asset status to be sold
listing.status = AssetStatus.Sold;
// transfer asset from seller to Swan, and then from Swan to buyer
// this ensure that only approval to Swan is enough for the sellers
SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
SwanAsset(_asset).transferFrom(address(this), listing.buyer, 1);
// transfer money
token.transferFrom(listing.buyer, address(this), listing.price);
token.transfer(listing.seller, listing.price);
emit AssetSold(listing.seller, msg.sender, _asset, listing.price);
}
Updates
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.