Submission Details
Severity:
Trustee::assetToPay is not updating properly
Description : When Owner calls the createEstateNFT(string memory _description, uint256 _value, address _asset) the assetToPay = _asset; is updated, if owner wants to create an another estate it is not updating according to the index, it is overwritting previous asset address.
Impact : If someone from the beneficiery calls the buyOutEstateNFT(uint256 _nftID) with _nftid:1 the function is accessing the most recently updated asset IERC20(assetToPay).safeTransferFrom(msg.sender, address(this), finalAmount); instead of asset associated with the user specified nftId:1, which cause the protocol to break.
Proof of Concepts :
`function test_createEstateNFTIsUpdatingCorrectly() public {
vm.startPrank(owner);
im.createEstateNFT("our beach-house", 2000000, address(Usdc));
console.log("NFT Id to value", im.getNftValue(1));
console.log("first call",im.getAassetToPay());
im.createEstateNFT("new huse", 100000 , address(Weth));
console.log("NFT Id to value", im.getNftValue(2));
console.log("second call",im.getAassetToPay());
im.addBeneficiery(user1);
im.addBeneficiery(user2);
im.addBeneficiery(user3);
vm.stopPrank();
vm.startPrank(user1);
vm.deal(user1, 2_000_000 * 1e6);
im.buyOutEstateNFT(1);
}`
Result :: `Ran 1 test for test/InheritanceManagerTest.t.sol:InheritanceManagerTest
[FAIL: panic: array out-of-bounds access (0x32)] test_createEstateNFTIsUpdatingCorrectly() (gas: 373050)
Logs:
NFT Id to value 2000000
first call 0x2e234DAe75C793f67A35089C9d99245E1C58470b
NFT Id to value 100000
second call 0xF62849F9A0B5Bf2913b396098F7c7019b51A820a
`
Recommended mitigation: Use the mapping to store the nftid=>asset, so that we can track assets efficiently.
Updates
Lead Judging Commences
0xtimefliez 10 months ago
Submission Judgement Published Assigned finding tags:
global asset in NFT values
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.