Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: low
Invalid

`BidBeastsNFTMarket:unlistNFT` function lacks protection against overly frequent operations by sellers.

minos

BidBeastsNFTMarket:unlistNFT function lacks protection against overly frequent operations by sellers.

Description

  • Under normal circumstances, after listing an NFT, the seller has the right to directly delist it.

  • However, if a malicious seller intentionally lists and then quickly delists the NFT, it can easily cause dissatisfaction among buyers.

  • The relevant code in BidBeastsNFTMarketPlace.sol is as follows:

function unlistNFT(uint256 tokenId) external isListed(tokenId) isSeller(tokenId, msg.sender) {
require(bids[tokenId].bidder == address(0), "Cannot unlist, a bid has been placed");
Listing storage listing = listings[tokenId];
listing.listed = false;
BBERC721.transferFrom(address(this), msg.sender, tokenId);
emit NftUnlisted(tokenId);
}

Risk

Likelihood:

  • Every time a buyer attempts to make an immediate purchase, the seller could potentially perform a malicious delisting.
    Impact:

  • Although there is no direct financial loss, it severely affects buyer enthusiasm, which contradicts the protocol's expectations.

Proof of Concept

  • None

Recommended Mitigation

  • It is recommended to add a time interval. Implement a cooldown period by adding a listing timestamp.

struct Listing {
address seller;
uint256 minPrice;
uint256 buyNowPrice;
+ uint256 listTimestamp;
uint256 auctionEnd;
bool listed;
}
function unlistNFT(uint256 tokenId) external isListed(tokenId) isSeller(tokenId, msg.sender) {
require(bids[tokenId].bidder == address(0), "Cannot unlist, a bid has been placed");
Listing storage listing = listings[tokenId];
require(block.timestamp - listing.listTimestamp >= 10, "The unlistNFT operations are happening too frequently.");
listing.listed = false;
​
BBERC721.transferFrom(address(this), msg.sender, tokenId);
​
emit NftUnlisted(tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Appeal created

minos Submitter
2 months ago
cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!