Part 2

Summary

src/trading-account-nft/TradingAccountNFT.sol

The _update function calls IPerpsEngine(owner()).notifyAccountTransfer(to, tokenId.toUint128()) without verifying that the owner() address is a valid contract implementing the `IPerpsEngine` interface

Vulnerability Details

The function assumes that the owner address is a valid contract that implements IPerpsEngine. If the owner is not a contract, the call will fail, potentially causing the function to revert and preventing expected behavior.

Impact

If the owner is not a contract or does not implement the IPerpsEngine interface, the contract will fail during execution, causing disruption in the expected flow of the contract's functions, Denial of Seervice (DoS).

Tools Used

Manual code review

Recommendations

Always add check to ensure that the owner() address is a valid contract before calling notifyAccountTransfer require(Address.isContract(owner()), "Owner is not a contract");