NFT Dealers

Links

• src/NFTDealers.sol:161-164 — cancelListing() with inline seller check

• src/NFTDealers.sol:76-79 — onlySeller modifier definition

• src/NFTDealers.sol:175 — collectUsdcFromSelling() using onlySeller modifier

• src/NFTDealers.sol:189 — updatePrice() using onlySeller modifier

Vulnerability Details

The cancelListing function performs the seller authorization check via an inline require statement:

Meanwhile, collectUsdcFromSelling and updatePrice use the dedicated onlySeller modifier for the same check:

Both approaches are functionally equivalent, but the inconsistency means that if the seller authorization logic ever needs to change, cancelListing would need to be updated separately. The modifier exists specifically to centralize this check.

Impact

No direct security impact — the protection is functionally identical. However, the inconsistency reduces code maintainability and increases the risk of divergent behavior if the seller check logic is updated in the modifier but not in the inline require.

Recommended Mitigation

Replace the inline require with the onlySeller modifier: