list() enforces MIN_PRICE only at listing creation, but updatePrice() later allows any value greater than zero. As a result, active listings can remain on the marketplace below the configured minimum price.

Description

• Normal behavior: the configured minimum price should remain enforced throughout the full listing lifecycle, not only when a listing is first created.

• Issue: updatePrice() does not preserve the same rule. It only checks that the new price is greater than zero:

Because of this inconsistency, a seller can create a valid listing and later reduce the price below MIN_PRICE, breaking the stated minimum-price policy for active listings.

Risk

Likelihood:

• Every active seller can access updatePrice() after creating a valid listing.

• The update path explicitly allows sub-floor values as long as the price is non-zero.

Impact:

• Active listings can exist below the configured MIN_PRICE, violating marketplace pricing rules.

• Integrators and users may rely on an invariant that the protocol does not actually preserve across listing updates.

Proof of Concept

The PoC demonstrates that a seller can create a listing at a valid price and then update it to a value below the configured minimum.

PoC rationale:
The test shows that the minimum-price rule is enforced only at listing creation, not across the full active-listing lifecycle.

Recommended Mitigation

The same price floor enforced in list() should also be enforced in updatePrice().

Mitigation rationale:
Applying the same floor check on both creation and update preserves pricing invariants for all active listings.