Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Swan assets are sent to BuyerAgent contract with no way to retrieve them.

inh3l

Summary

BuyerAgent.sol has no functionality to retrieve the SwanAsset NFTs making them stuck forever.

Vulnerability Details

The purchase function sends the SwanAsset to the addresss listed as buyer which is BuyerAgent contract.

function purchase(address _asset) external {
AssetListing storage listing = listings[_asset];
​
// asset must be listed to be purchased
if (listing.status != AssetStatus.Listed) {
revert InvalidStatus(listing.status, AssetStatus.Listed);
}
​
// can only the buyer can purchase the asset
if (listing.buyer != msg.sender) {
revert Unauthorized(msg.sender);
}
​
// update asset status to be sold
listing.status = AssetStatus.Sold;
​
// transfer asset from seller to Swan, and then from Swan to buyer
// this ensure that only approval to Swan is enough for the sellers
SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
@> SwanAsset(_asset).transferFrom(address(this), listing.buyer, 1);
​
// transfer money
token.transferFrom(listing.buyer, address(this), listing.price);
token.transfer(listing.seller, listing.price);
​
emit AssetSold(listing.seller, msg.sender, _asset, listing.price);
}

BuyerAgent.sol however has no way/corresponding function to retrieve the NFT as there's no equivalent function to withdraw the SwanAsset to the owner.

Impact

SwanAsset is stuck in BuyerAgent contract with no way to retrive it, leading to loss of NFT and loss of funds spent to purchase it.

Tools Used

Manual Review.

Recommendations

Introduce an owner protected function to withdrawn the SwanAsset to a valid recipient.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.