Pieces Protocol

First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Severity: medium
Invalid

Function sellErc20 reverts with error TokenDivider__InsuficientBalance when NFT address is invalid.

Summary

Function sellErc20 reverts with error TokenDivider__InsuficientBalance when NFT address is invalid. This is a misleading error. It doesnt tell user what actually is wrong with the input.

Vulnerability Details

Function sellErc20 doesnt have a check if the nftAddress is invalid. There is a check if nftAddress is address(0). But if user enters an invalid non-zero address, TokenDivider__InsuficientBalance is thrown which is not a valid error message for the input. Balance is sufficient but address is incorrect.

Following is POC to replicate the issue. Paste Below code in the unit test - TokenDividerTest.t.sol and run the test.

function testSellAndBuyUsingInvalidNFTAddress() public {
uint256 PRICE = 1e18; // Price of ERC20 Tokens
address inValidNFTAddress = address(1); // Invalid NFT Address
vm.startPrank(USER);
// Step 1 - User Locks NFT and get ERC tokens
erc721Mock.approve(address(tokenDivider), TOKEN_ID);
tokenDivider.divideNft(address(erc721Mock), TOKEN_ID, AMOUNT);
ERC20Mock erc20Mock = ERC20Mock(
tokenDivider.getErc20InfoFromNft(address(erc721Mock)).erc20Address
);
erc20Mock.approve(address(tokenDivider), AMOUNT);
// Step 2 - User tries to sell ERC tokens but enters invalid NFT Address. Notice that user gets error TokenDivider__InsuficientBalance.
vm.expectRevert(TokenDivider.TokenDivider__InsuficientBalance.selector);
tokenDivider.sellErc20(inValidNFTAddress, PRICE, AMOUNT);
vm.stopPrank();
}

Impact

Error message is misleading. Bad user experience. User may try again with different amount not knowing that its actually the address which is wrong. Thus wasting gas and time.

Tools Used

Foundry

Recommendations

Add a validation if nftAddress exists in the mapping nftToErc20Info and is mapped to valid ERC20 Address.Throw an error like - InputNFTAddressDoesntExist. This will be a better user experience

Updates

Lead Judging Commences

fishy Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.