Submission Details
Severity:
Incorrect Transfer Logic in buyOutEstateNFT Function
Description : Incorrect Transfer Logic: The function incorrectly transfers the finalAmount / divisor to all beneficiaries, including the buyer, when it should only transfer to the non-buying beneficiaries.
Impact: The function fails to properly distribute the finalAmount among the beneficiaries.
Proof of Concepts-
Recommended mitigation `function buyOutEstateNFT(uint256 _nftID) external onlyBeneficiaryWithIsInherited { uint256 value = nftValue[_nftID]; uint256 divisor = beneficiaries.length; uint256 multiplier = beneficiaries.length - 1; uint256 finalAmount = (value / divisor) * multiplier;
IERC20(assetToPay).safeTransferFrom(msg.sender, address(this), finalAmount);
for (uint256 i = 0; i < beneficiaries.length; i++) {
if (msg.sender == beneficiaries[i]) {
continue; // Skip the buyer from receiving funds
} else {
IERC20(assetToPay).safeTransfer(beneficiaries[i], finalAmount / multiplier); // Corrected division
}
}
nft.burnEstate(_nftID);
Updates
Lead Judging Commences
0xtimefliez 3 months ago
Submission Judgement Published Assigned finding tags:
buyOutNFT has wrong denominator
buyOutNFT has return instead of continue
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.