Pieces Protocol

Summary

The sellErc20 function in TokenDivider.sol does not properly validate the price parameter, allowing it to be set to 0.

Vulnerability Details

1. The price parameter is used in the SellOrder struct creation.

2. Setting price to 0 means creating a SellOrder with a price of 0.

   function sellErc20(address nftPegged, uint256 price, uint256 amount) external {

   // ... other checks ...

   ​

   s_userToSellOrders[msg.sender].push(

   SellOrder({

   seller: msg.sender,

   erc20Address: tokenInfo.erc20Address,

   price: price, // This will be set to 0 if not checked

   amount: amount

   })

   );

   ​

   emit OrderPublished(amount, msg.sender, nftPegged);

   ​

   IERC20(tokenInfo.erc20Address).transferFrom(msg.sender, address(this), amount);

   }

   ​

• The vulnerability occurs because there's no validation for the price parameter before creating the SellOrder.

• This allows for the creation of orders with zero value, which could disrupt the intended functionality of the contract.

Impact

Impact:

1. Market Manipulation: An attacker could create sell orders with price=0, flooding the market with unattractive orders.

1. Gas Waste: The contract will still process these orders, potentially wasting gas on unnecessary operations.

Tools Used

manual review

Recommendations

Add a check for price > 0 before creating the SellOrder. If price is 0, revert the transaction with an appropriate error message.