NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

Inconsistent price check in `list()` and `updatePrice()`

Author Revealed upon completion

Root + Impact

Description

  • The protocol expects each NFT being listed to be above MIN_PRICE , but when a seller first list() the NFT with price larger or equal to MIN_PRICE, then call updatePrice(), he can lower the NFT price below MIN_PRICE.

// Root cause in the codebase with @> marks to highlight the relevant section
function updatePrice(uint256 _listingId, uint32 _newPrice) external onlySeller(_listingId) {
Listing memory listing = s_listings[_listingId];
uint256 oldPrice = listing.price;
if (!listing.isActive) revert ListingNotActive(_listingId);
@> require(_newPrice > 0, "Price must be greater than 0");
​
s_listings[_listingId].price = _newPrice;
emit NFT_Dealers_Price_Updated(_listingId, oldPrice, _newPrice);
}

Risk

Likelihood:

  • When a seller calls list() and then updatePrice() with less than MIN_PRICE, he will be able to set an NFT price lower than what the protocol expect.

Impact:

  • The impact is that owner could potentially earn a lot less fee than he expected due to circumventing the MIN_PRICE check.

Proof of Concept

A user can call list() and then updatePrice() to make an NFT listed lower than MIN_PRICE.

// A user can call list() and then updatePrice() to make an NFT listed lower than MIN_PRICE.
nftDealer.list(1, MIN_PRICE);
nftDealer.updatePrice(1, MIN_PRICE - 2e5);

Recommended Mitigation

Update the _newPrice check from 0 to MIN_PRICE in updatePrice().

function updatePrice(uint256 _listingId, uint32 _newPrice) external onlySeller(_listingId) {
Listing memory listing = s_listings[_listingId];
uint256 oldPrice = listing.price;
if (!listing.isActive) revert ListingNotActive(_listingId);
- require(_newPrice > 0, "Price must be greater than 0");
+ require(_newPrice >= MIN_PRICE, "Price must be greater than or equal MIN_PRICE");
​
s_listings[_listingId].price = _newPrice;
emit NFT_Dealers_Price_Updated(_listingId, oldPrice, _newPrice);
}
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!