NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: high

Redundant Self-Transfer of Fees in collectUsdcFromSelling

Author Revealed upon completion

Root + Impact

Description

  • Normal Behavior: When a seller collects their funds, the protocol should calculate the fee, update the totalFeesCollected accumulator, and send the remaining balance to the seller. The fees should simply remain in the contract's balance until the owner withdraws them.


  • Specific Issue: The contract explicitly calls usdc.safeTransfer(address(this), fees). Since the USDC is already held by the NFTDealers contract (deposited by the buyer during the buy function), transferring it to itself is redundant.

function collectUsdcFromSelling(uint256 _listingId) external onlySeller(_listingId) {
...
uint256 fees = _calculateFees(listing.price);
totalFeesCollected += fees;
// @> Root Cause: The contract already owns this USDC.
// @> This call wastes gas on internal ERC20 balance updates.
@> usdc.safeTransfer(address(this), fees);
usdc.safeTransfer(msg.sender, amountToSeller);
}

Risk

Likelihood: High

  • Reason 1: This line is reached in every successful execution of the collection logic.

Impact: Low (Gas)

  • Impact 1: Wasted Gas. Each call to safeTransfer triggers an external call to the USDC contract, which performs balance checks, updates mapping slots, and emits a Transfer event. This costs approximately 5,000–10,000 gas per call.

  • Impact 2: Log Noise. It emits unnecessary Transfer events from NFTDealers to NFTDealers, cluttering off-chain indexers.

Proof of Concept

​

Recommended Mitigation

Remove the self-transfer line entirely. The accounting is already handled by the totalFeesCollected += fees; statement.

function collectUsdcFromSelling(uint256 _listingId) external onlySeller(_listingId) {
...
totalFeesCollected += fees;
- usdc.safeTransfer(address(this), fees);
usdc.safeTransfer(msg.sender, amountToSeller);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!