NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

updatePrice Minimum Price Validation Is Inconsistent with list

Author Revealed upon completion

Root + Impact

Description

  • list() enforces require(_price >= MIN_PRICE) (1 USDC) to prevent zero-value or dust-level listings and protect buyers from accidental purchases at negligible prices.

  • updatePrice only requires _newPrice > 0, permitting a seller to reduce an active listing price to 1 wei USDC — bypassing the floor that list() establishes. A buyer (potentially colluding with the seller) can then acquire the NFT at a near-zero cost.

function updatePrice(uint256 _listingId, uint32 _newPrice) external {
...
@> require(_newPrice > 0, "Price must be greater than 0");
// @> BUG: should mirror list() and require _newPrice >= MIN_PRICE
}

Risk

Likelihood:

  • Any whitelisted seller with an active listing can call updatePrice at any time — no special preconditions required.

  • The manipulation can be targeted at a specific colluding buyer via off-chain coordination, making it a reliable griefing or value-extraction vector.

Impact:

  • A seller and colluding buyer can engineer a near-zero price purchase, extracting protocol value and undermining fair market conditions for other participants.

Proof of Concept

Add this to 2026-03-NFT-dealers/test/NFTDealersTest.t.sol,run forge test --match-test testPoC_M01_UpdatePriceBelowMinPrice -vvvv

function testPoC_M01_UpdatePriceBelowMinPrice() public revealed {
uint256 tokenId = 1;
uint32 initialPrice = 1000e6;
​
mintAndListNFTForTesting(tokenId, initialPrice);
​
vm.prank(userWithCash);
nftDealers.updatePrice(1, 1);
​
(, uint32 updatedPrice,,,) = nftDealers.s_listings(1);
assertEq(updatedPrice, 1, "M-01: price updated to 1 wei, bypassing MIN_PRICE");
}
​

Recommended Mitigation

Replace the > 0 check in updatePrice with the same >= MIN_PRICE threshold used in list().

function updatePrice(uint256 _listingId, uint32 _newPrice) external {
...
- require(_newPrice > 0, "Price must be greater than 0");
+ require(_newPrice >= MIN_PRICE, "Price must be at least MIN_PRICE");
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!