NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

Non-whitelisted users are unable to list their NFTs, leading to a permanent Denial of Service (DoS)

Author Revealed upon completion

Root + Impact

Description

  • Normal Behavior: Secondary market participants who purchase an NFT from the original minter should be able to list their NFT for sale to maintain the liquidity and utility of the collection.


  • Specific Issue: The list function is protected by the onlyWhitelisted modifier. This means that while any user can buy an NFT (via the buy function, which has no whitelist check), a non-whitelisted buyer is immediately blocked from ever re-selling that NFT on the protocol.

@> function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted {
...
}

Risk

Likelihood: High

  • Reason 1: Any secondary purchase by a non-whitelisted address will trigger this state.

  • Reason 2: The current architecture assumes only original minters are allowed to participate in the marketplace logic.

Impact: High

  • Impact 1: Permanent Denial of Service for secondary market sellers.

  • Impact 2: Severe reduction in protocol volume and utility, as the "Dealers" marketplace is unusable for the general public.

Proof of Concept

Paste this test function in NFTDealersTest.t.sol

function test_DoSForNonWhitelistedUsers() public revealed {
address randomUser = makeAddr("randomUser");
deal(address(nftDealers), randomUser, 1);
vm.prank(randomUser);
vm.expectRevert();
nftDealers.list(1, 1e6);
}

Recommended Mitigation

Remove the onlyWhitelisted modifier from the list function to allow all NFT owners to participate in the marketplace.

- function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted {
+ function list(uint256 _tokenId, uint32 _price) external {
require(_price >= MIN_PRICE, "Price must be at least 1 USDC");
require(ownerOf(_tokenId) == msg.sender, "Not owner of NFT");
...
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!