Submission Details
Severity:
`InheritanceManager:buyOutEstateNFT` can fail due to insufficient allowance and can lead to unnecessary gas spending
Vulnerability Details
Before the transaction, the function does not check the user's allowance and transacts directly. If the allowance is insufficient, this will revert
Impact
Low - Gas consumption
Recommendations
Add an allowance check before the transaction and revert safely
function buyOutEstateNFT(
uint256 _nftID
) external onlyBeneficiaryWithIsInherited {
uint256 value = nftValue[_nftID];
uint256 divisor = beneficiaries.length;
uint256 multiplier = beneficiaries.length - 1;
uint256 finalAmount = (value / divisor) * multiplier;
+ uint256 allowance = IERC20(assetToPay).allowance(msg.sender, address(this));
+ require(allowance >= finalAmount, "Insufficient allowance");
IERC20(assetToPay).safeTransferFrom(
msg.sender,
address(this),
finalAmount
);
...
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.