Submission Details
Impact:
Likelihood:
No Input Validation for _BidBeastsNFT in Constructor
Root + Impact
Description
The constructor accepts an _BidBeastsNFT address but does not validate that it is a valid ERC721 contract or non-zero address.
constructor(address _BidBeastsNFT) {
BBERC721 = BidBeasts(_BidBeastsNFT);
}
Risk
Impact:
If an invalid or malicious contract address is provided, the marketplace could become unusable or vulnerable to exploits.
Proof of Concept
Not Required.
Recommended Mitigation
Add validation to ensure _BidBeastsNFT is a valid contract .
constructor(address _BidBeastsNFT) {
+require(_BidBeastsNFT!= address(0));
BBERC721 = BidBeasts(_BidBeastsNFT);
}
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.