Submission Details
Severity:
Add Receive() payable function in NFTLiquidator contract
Vulnerability Details
function placeBid uses msg.value to send ETH but NFTLiquidator contract no receive function to accept it
/**
* @dev Allows users to place bids on liquidated NFTs
* @param tokenId The ID of the NFT being auctioned
*/
function placeBid(uint256 tokenId) external payable {
TokenData storage data = tokenData[tokenId];
if (block.timestamp >= data.auctionEndTime) revert AuctionHasEnded();
uint256 minBidAmount = data.highestBid + (data.highestBid * minBidIncreasePercentage / 100);
if (msg.value <= minBidAmount) revert BidTooLow(minBidAmount);
if (data.highestBidder != address(0)) {
payable(data.highestBidder).transfer(data.highestBid);
}
data.highestBid = msg.value;
data.highestBidder = msg.sender;
emit BidPlaced(tokenId, msg.sender, msg.value);
}
Impact
ETH will be lost
Tools Used
Recommendations
Add receive() payable function in NFTLiquidator contract.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.