Submission Details
Severity:
Global `assetToPay` Overwrite in NFT Creation
Summary
The assetToPay variable is globally shared across all NFTs, causing later NFTs to overwrite previous payment token settings.
Vulnerability Details
In createEstateNFT, assetToPay is updated for every NFT creation. This means only the last NFT’s payment token is retained, rendering earlier NFTs’ assetToPay values invalid.
Impact
Beneficiaries purchasing earlier NFTs will use the wrong token, leading to failed transactions or unintended token transfers.
Tools Used
Manual review.
Recommendations
Convert assetToPay into a mapping: mapping(uint256 => address) assetToPay. Update setAssetToPay to accept an NFT ID parameter.
Updates
Lead Judging Commences
0xtimefliez 10 months ago
Submission Judgement Published Assigned finding tags:
global asset in NFT values
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.