Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Payment Token Validation in buyOrder Function

kweks

Description: The buyOrder function incorrectly claims to accept "any token" for payment, but only accepts ETH. The NatSpec comment misrepresents the function's actual implementation.

Impact:

  • Potential user confusion due to misleading documentation

  • Security risk if users misunderstand the payment mechanism

  • Reduced contract transparency

Proof of Concept:

function buyOrder(uint256 orderIndex, address seller) external payable {
// Function only accepts ETH via msg.value
// No mechanism to accept other ERC tokens as payment
if(msg.value < order.price) {
revert TokenDivider__IncorrectEtherAmount();
}
}

Recommended Mitigation:

  • Update the NatSpec comment to accurately reflect that only ETH is accepted

  • Consider adding explicit documentation about the ETH-only payment mechanism

  • If multi-token payments are desired, implement a more flexible payment system that can handle different token types

Updates

Lead Judging Commences

fishy Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.