Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

A purchased listing does not get deleted from the listings mapping.

modey

Summary

A purchased listing does not get deleted from the listings mapping.

Vulnerability Details

When a listing is created in Swan::list it gets registered in the Listings mapping. However, when the listing is purchased, in Swan::purchase the entry does not get deleted.

Impact

The listing remains in the listings mapping even though the asset has been sold.

Although the status is updated to AssetStatus.Sold If listings are not deleted after purchase, they will accumulate in the listings mapping indefinitely, increasing storage costs for the contract. This can be problematic, especially if the contract is frequently used and storage space grows, leading to increased gas costs over time.

Tools Used

Manual Review

Recommendations

In the purchase function, a purchased listing should be deleted from the listings mapping. The function can be implemented as below:

​
function purchase(address _asset) external {
AssetListing storage listing = listings[_asset];
​
// asset must be listed to be purchased
if (listing.status != AssetStatus.Listed) {
revert InvalidStatus(listing.status, AssetStatus.Listed);
}
​
// can only the buyer can purchase the asset
if (listing.buyer != msg.sender) {
revert Unauthorized(msg.sender);
}
​
// update asset status to be sold
listing.status = AssetStatus.Sold;
​
// transfer asset from seller to Swan, and then from Swan to buyer
// this ensure that only approval to Swan is enough for the sellers
SwanAsset(_asset).transferFrom(listing.seller, address(this), 1);
SwanAsset(_asset).transferFrom(address(this), listing.buyer, 1);
​
// transfer money
token.transferFrom(listing.buyer, address(this), listing.price);
token.transfer(listing.seller, listing.price);
+ delete listings[_asset];
emit AssetSold(listing.seller, msg.sender, _asset, listing.price);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.