Severity: High
Vulnerability Type: Denial of Service (DoS), Storage Bloat

Overview

The SpookySwap contract’s trickOrTreat function allows users to purchase NFTs at three different price points: standard price, double price ("trick"), and half price ("treat"). However, the double-price ("trick") mechanism introduces a critical vulnerability that can lead to denial of service (DoS) and excessive storage consumption, posing significant risks to the contract’s functionality and performance.

Vulnerability Description

1. Unbounded pendingNFTs Mapping

The contract stores NFTs that have been partially paid for but not yet fully purchased in a pendingNFTs mapping. There is no limit on the number of entries that can be stored in this mapping. This allows a malicious user to repeatedly trigger the "trick" scenario (by only sending the initial portion of the required ETH), resulting in an indefinite number of entries in the pendingNFTs mapping. This behavior can quickly consume the contract's storage capacity, potentially leading to higher gas costs for any subsequent operations involving the contract.

2. Absence of Duplicate Entry Check

The contract does not implement a mechanism to prevent duplicate entries for the same user and treat combination within the pendingNFTs mapping. This can result in multiple entries being created for the same user, leading to inconsistencies, unintended behavior, and further strain on the contract’s storage.

3. Lack of Expiration Mechanism for Pending NFTs

Once an NFT is stored in the pendingNFTs mapping as a pending transaction, there is no expiration or timeout mechanism. This means that if a user fails to complete the transaction (by calling the resolveTrick function), the entry remains indefinitely in the contract’s storage. This could result in persistent storage bloat over time, increasing the risk of DoS due to storage exhaustion.

Vulnerable Code

The following code snippet from the trickOrTreat function illustrates the issue:

Issues in the Code:

• Unbounded Mapping: No constraints on the number of pendingNFTs entries.

• Missing Duplicate Checks: No validation to ensure that a user does not have multiple pending entries for the same treat.

• No Expiration Mechanism: Entries in pendingNFTs remain until the user completes the purchase manually.

Proof of Concept

The following test script demonstrates how an attacker could exploit the vulnerability to perform a denial-of-service attack

Impact

1. Denial of Service (DoS)

An attacker can exploit the absence of restrictions on the pendingNFTs mapping to create numerous pending entries, effectively filling up the contract's storage space. This can slow down or prevent legitimate users from interacting with the contract, making the trickOrTreat function and potentially the entire contract unusable.

1. Storage Bloat

Due to the lack of a limit on pending entries and the absence of an expiration mechanism, the pendingNFTs mapping can grow uncontrollably. This can significantly increase the gas costs for any transactions interacting with the contract, potentially leading to prohibitive costs for users and making the contract economically unfeasible to use.