Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unauthorized NFT Acquisition via buyBackNFT Function

BBnDD

Summary

The buyBackNFT function in the NFTLiquidator contract is designed to allow the previous owner of an NFT to repurchase it at a premium of 110% of the associated debt during an active auction. However, due to the absence of access restrictions, any user can invoke this function. This loophole enables malicious actors to acquire the NFT at the buyback price, even when higher bids exist, thereby undermining the auction's integrity.

Vulnerability details

Function `buyBackNFT:

function buyBackNFT(uint256 tokenId) external payable {
TokenData storage data = tokenData[tokenId];
if (block.timestamp >= data.auctionEndTime) revert AuctionHasEnded(); if (nftContract.ownerOf(tokenId) != address(this)) revert NFTNotInLiquidation();
uint256 price = data.debt * 11 / 10; // 110% of the debt
if (msg.value < price) revert InsufficientPayment(price); // Refund the highest bidder if there's an existing bid
if (data.highestBidder != address(0)) {
payable(data.highestBidder).transfer(data.highestBid);
}
delete tokenData[tokenId];
nftContract.transferFrom(address(this), msg.sender, tokenId);
payable(stabilityPool).transfer(price);
if (msg.value > price) {
payable(msg.sender).transfer(msg.value - price);
}
emit BuybackCompleted(tokenId, msg.sender, price);
}

The function lacks a mechanism to verify that the caller is the previous owner of the NFT. Consequently, any user can call buyBackNFT and purchase the NFT for 110% of its debt. If the current highest bid exceeds this amount, a malicious actor can exploit this vulnerability to obtain the NFT below its fair market value, effectively bypassing legitimate bidders.

Impact

Auction Integrity Compromise: Unauthorized users can circumvent the competitive bidding process, leading to unfair acquisition of NFTs.

Tools Used

manual review

Recommendations

Track the previous owner of the listed NFTs and restrict the access of buyBackNFT() to be callable only by the previous owner of the NFT.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.