Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[H-6] Creating more than one NFT with InheritanceManager::createEstateNFT can override the InheritanceManager::assetToPay

0xnick

Summary

The function is used to tokenize real estate assets. If the owner wants tokenize more than a single real estate but list it in different tokens the second one will override the previous assetToPay value.

Vulnerability Details

Likelihood: Medium. Requires the owner to create multiple NFTs with different assets, a plausible but not default scenario.

It is possible to list a real estate for 100 ETH, then involuntarily list another real estate for 200,000 USDC. This will override the previous NFT asset leading to a price of 100e12 USDC - which is infeasible.

Another scenario is when tokens have the same decimals. Again if we list for 100 ETH, but afterwards list another for 2,000,000 BNB. This means that the first property can be bought for 100 BNB which is a lot underpriced.

This test shows that it will revert because we successfully bought the NFT.

function test_buyOutEstateNFTInDifferentAsset() public {
address user2 = makeAddr("user2");
address user3 = makeAddr("user3");
vm.warp(1);
vm.startPrank(owner);
im.addBeneficiery(user1);
im.addBeneficiery(user2);
im.addBeneficiery(user3);
im.createEstateNFT("our beach-house", 100e18, address(weth));
im.createEstateNFT("our beach-house 2", 2000000e18, address(bnb));
vm.stopPrank();
​
bnb.mint(user3, 100e18);
​
vm.warp(1 + 90 days);
vm.startPrank(user3);
bnb.approve(address(im), 100e18);
​
im.inherit();
im.buyOutEstateNFT(1);
​
vm.stopPrank();
​
NFTFactory nft = im.getNft();
​
vm.expectRevert(abi.encodeWithSelector(IERC721Errors.ERC721NonexistentToken.selector, 1));
nft.ownerOf(1);
}

Impact

High. The incorrect type of asset can be distributed to beneficiaries, which can have huge difference in terms of USD price.

Tools Used

  • Manual Review

Recommendations

In the nftValue mapping, store a struct as the value which holds the value and the asset.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

global asset in NFT values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.