NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

Non-whitelisted users cannot list their NFTs

Author Revealed upon completion

Root + Impact

Description

  • As specified in the README, non-whitelisted users should be able to list NFTs.

  • Currently non-whitelisted users won't be able to list NFTs due to onlyWhitelistedmodifier check in list() function.

// Root cause in the codebase with @> marks to highlight the relevant section
@> function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted {
//...
}

Risk

Likelihood:

  • When a non-whitelisted user trying to list an NFT, this transaction is blocked by the onlyWhitelistedmodifier check.

Impact:

  • All non-whitelisted users won't be able to list NFTs.

Proof of Concept

Non-whitelisted users after purchasing NFTs from whitelisted users, won't be able to list and sell NFTs.

// Non-whitelisted users, after purchasing NFTs from whitelisted users, won't be able to list and sell NFTs.

Recommended Mitigation

Remove the modifier check in list() function so both whitelisted and non-whitelisted users can call the function.

- function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted {
+ function list(uint256 _tokenId, uint32 _price) external {

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!