Submission Details
Impact:
Likelihood:
Missing Input Validation for Extreme Values in the `BidBeastsNFTMarketplace::listNFT()` function
Description
-
Smart contracts should validate input parameters to prevent unexpected behavior with extreme values.
-
The
BidBeastsNFTMarketplace::listNFT()function accepts extremely large values forminPriceandbuyNowPricewithout reasonable upper bounds validation.
require(BBERC721.ownerOf(tokenId) == msg.sender, "Not the owner");
require(_minPrice >= S_MIN_NFT_PRICE, "Min price too low");
if (_buyNowPrice > 0) {
@> require(_minPrice <= _buyNowPrice, "Min price cannot exceed buy now price");
}
Risk
Likelihood:
-
Users could accidentally set extremely high prices
-
May cause arithmetic issues in fee calculations
Impact:
-
Potential arithmetic overflow in bid calculations
-
Unusable NFT listings due to unrealistic prices
Proof of Concept
function test_LOW_ExtremeValueValidation() public {
// Test with maximum possible values
vm.prank(OWNER);
uint256 tokenId = nft.mint(ALICE);
vm.startPrank(ALICE);
nft.approve(address(market), tokenId);
// Should validate against extremely high values
market.listNFT(tokenId, type(uint256).max - 1000, type(uint256).max);
vm.stopPrank();
// Listing succeeds with extreme values, which might cause issues
BidBeastsNFTMarket.Listing memory listing = market.getListing(tokenId);
assertEq(
listing.minPrice,
type(uint256).max - 1000,
"Should accept extreme min price"
);
}
Recommended Mitigation
+ uint256 constant public MAX_NFT_PRICE = 1000000 ether; // Reasonable maximum
function listNFT(uint256 tokenId, uint256 _minPrice, uint256 _buyNowPrice) external {
require(BBERC721.ownerOf(tokenId) == msg.sender, "Not the owner");
require(_minPrice >= S_MIN_NFT_PRICE, "Min price too low");
+ require(_minPrice <= MAX_NFT_PRICE, "Min price too high");
if (_buyNowPrice > 0) {
require(_minPrice <= _buyNowPrice, "Min price cannot exceed buy now price");
+ require(_buyNowPrice <= MAX_NFT_PRICE, "Buy now price too high");
}
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.