NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: high

Non-Whitelisted Users Cannot List

Author Revealed upon completion

Incorrect inclusion of the onlyWhitelisted modifier on the list() function prevents secondary market participation by non-whitelisted users.

Description

  • According to README.md, non-whitelisted users should be able to "buy, update price, cancel listing, list NFT" and "collect USDC after selling". However, The list() function in NFTDealers.sol is restricted with the onlyWhitelisted modifier, preventing non-whitelisted users from reselling NFTs they have purchased.

function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted { // @> Restricted to whitelisted users
// ...
}

Risk

Likelihood:

  • Any non-whitelisted user who purchases an NFT via the protocol will attempt to use the protocol's secondary market features as described in the documentation.

Impact:

  • Non-whitelisted users are "trapped" with their NFTs, unable to resell them on the platform despite documentation stating they should be able to.

Proof of Concept

function testNonWhitelistedCannotList_Bug() public revealed {
// 1. Setup: Whitelisted Alice mints and lists an NFT
mintAndListNFTForTesting(1, 1000e6);
​
// 2. Non-whitelisted Bob buys the NFT
address bob = makeAddr("bob");
usdc.mint(bob, 1000e6);
vm.startPrank(bob);
usdc.approve(address(nftDealers), 1000e6);
nftDealers.buy(1);
assertEq(nftDealers.ownerOf(1), bob, "Bob now owns the NFT");
​
// 3. Bob tries to list it for resale (as permitted by README)
// This will FAIL because of the onlyWhitelisted modifier in code
vm.expectRevert("Only whitelisted users can call this function");
nftDealers.list(1, 2000e6);
vm.stopPrank();
}

Recommended Mitigation

Remove the onlyWhitelisted modifier from the list() function to align the implementation with the documentation and allow a secondary market for all users.

- function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted {
+ function list(uint256 _tokenId, uint32 _price) external {
// ...
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!