Submission Details
Severity:
setAssetToPay can set any address as an asset
Summary
Function setAssetToPay can set value assetToPay as any address (e.g. eoa, zero address) with out checks
Vulnerability Details
Function setAssetToPay can set value assetToPay as any address (e.g. eoa, zero address) with out checks
function setAssetToPay(address _asset) external onlyTrustee {
assetToPay = _asset;
}
Impact
Setting an invalid token address will cause
buyOutEstateNFT()to fail at runtime
Tools Used
Manual code review
Recommendations
Implement basic validation checks for EOA, IERC20
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.