Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Buyers don't know the SellerFee is include in the price, this will cause a lot of revert transactions

duma999

Buyers don't know the SellerFee is include in the price, this will cause a lot of revert transactions

Description: The tokenDivider::getOrder contains the following line of code

uint256 fee = order.price / 100;
uint256 sellerFee = fee / 2;
​
if(msg.value < order.price + sellerFee) {
revert TokenDivider__InsuficientEtherForFees();
}

The problem is that the buyers doesn't know the amount of SellerFee to pay unless they look into the code directly.
When they want to know of much they need to paid to have their erc20 token, they use the following function

function getOrderPrice(address seller, uint256 index) public view returns(uint256 price) {
price = s_userToSellOrders[seller][index].price;
}

it return just the price and not the SellerFee.

Impact: It will result in a lot of revert transactions as the buyers need to look into the code directly to know how the sellerFee is calculated and do the math themselves. Impacting the bussiness of this solution.

Proof of Concept: Add the following test to the TokenDividerTest.t.sol test file.

function testBuyerDoesNotKnowTheSellerFee() public nftDivided {
ERC20Mock erc20Mock = ERC20Mock(tokenDivider.getErc20InfoFromNft(address(erc721Mock)).erc20Address);
​
vm.startPrank(USER);
​
erc20Mock.approve(address(tokenDivider), AMOUNT);
tokenDivider.sellErc20(address(erc721Mock), 9e18, AMOUNT); // USER create an order of sell for 9 ether
uint256 fee = AMOUNT / 100;
uint256 sellerFee = fee / 2;
vm.stopPrank();
vm.prank(USER2);
// The Buyer need to buy for 9 + SellerFee but he doesn't know the sellerfee
uint256 price = tokenDivider.getOrderPrice(address(USER), 0);
console.log("Price show : %s", price);
console.log("Actual Price to pay %s", price + sellerFee); // the buyer doesn't know this, he/she need to look to the code, it is not normal i think.
tokenDivider.buyOrder{value: 9e18}(0, USER);
// [FAIL: TokenDivider__InsuficientEtherForFees()]
}

Tool used: Manual

Recommended Mitigation: Add the following line to TokenDivider::getOrderPrice function.

function getOrderPrice(address seller, uint256 index) public view returns(uint256) {
uint256 price = s_userToSellOrders[seller][index].price;
uint256 fee = price / 100;
uint256 sellerFee = fee / 2;
return price + sellerFee;
}
Updates

Lead Judging Commences

fishy Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.