Trick or Treat

Summary:

The user loses money, when in pending state, if the withdrawFees function is called.

Vulnerability Details:

If a user initiates a “trick” purchase (double-cost) but pays only part of the cost, their ETH is held in the contract until they call resolveTrick. During this period, the funds are "pending" and intended for completing the NFT purchase. However, because withdrawFees does not account for these pending funds, the contract owner could accidentally withdraw them, potentially preventing the user from finishing their transaction.

Impact:

Potential loss of funds for the user.

Tools Used:

Manual review

Recommendations:

Adjust withdrawFees Logic: Ensure that withdrawFees only withdraws the contract’s free balance, excluding pending funds.