NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Slippage Protection in `buy` function

etherengineer

Root + Impact

Description

  • Normal Behavior: When a buyer initiates a transaction to purchase an NFT, they expect to pay the price that was displayed to them at the time of the call.


  • Specific Issue: The buy function does not include a maximum price parameter or a slippage check. Since the updatePrice function allows a seller to change the price of an active listing at any time, a malicious seller can observe a pending buy transaction in the mempool and front-run it by calling updatePrice to significantly increase the cost.

@> function buy(uint256 _listingId) external payable {...}

Risk

Likelihood: High

  • Reason 1: Transaction front-running is a common attack vector on public blockchains.

  • Reason 2: Sellers have a direct financial incentive to increase the price when they see a guaranteed buyer.

Impact: Medium

  • Impact 1: Financial Loss. Buyers may end up paying significantly more USDC than they intended.

  • Impact 2: Trust Erosion. Users may be hesitant to use a marketplace where prices can be manipulated during the "checkout" process.

Proof of Concept

function test_NoSlippageProtection() public revealed {
uint256 tokenId = 1;
uint32 initialPrice = 10e6;
uint32 newPrice = 100e6;
mintAndListNFTForTesting(tokenId, initialPrice);
address randomUser = makeAddr("randomUser");
deal(address(usdc), randomUser, 100e6);
​
// Before user could finish buy tx, price gets updated
vm.prank(userWithCash);
nftDealers.updatePrice(tokenId, newPrice);
​
vm.prank(randomUser);
usdc.approve(address(nftDealers), 100e6);
​
vm.prank(randomUser);
nftDealers.buy(tokenId);
​
assertEq(usdc.balanceOf(randomUser), 0, "Price Changed before user could finish tx");
}

Recommended Mitigation

Add a maxPrice parameter to the buy function and verify that the current listing price does not exceed it.

Updates

Lead Judging Commences

rubik0n Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

front-run-price-manipulation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!