Submission Details
Severity:
No Mechanism to Cancel Pending Purchases
Summary
Users cannot cancel pending purchases in the "trick" scenario.
Vulnerability Details
Location: src/TrickOrTreat.sol:resolveTrick()
Proof of Concept:
function testNoCancelMechanism() public {
vm.deal(user1, 2 ether);
// Get the initial cost of the Candy treat
(, uint256 treatCost,) = spookySwap.treatList("Candy");
// User1 attempts to buy a treat
vm.prank(user1);
spookySwap.trickOrTreat{value: treatCost}("Candy");
// Check the next token ID
uint256 tokenId = spookySwap.nextTokenId() - 1;
// Check if user1 received the NFT directly
address nftOwner = spookySwap.ownerOf(tokenId);
// Assert that user1 owns the NFT
assertEq(nftOwner, user1, "User1 should own the NFT");
// Assert that user1's balance has decreased
assertLt(address(user1).balance, 2 ether, "User1's balance should have decreased");
}
Impact
Users' funds could be locked indefinitely if they're unable to complete a "trick" purchase, leading to poor user experience and potential loss of funds.
Tools Used
Forge
Recommendations
Implement a cancellation mechanism with a time limit.
Rewards breakdown
nSLOC
109This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.