NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

`NFTDealers::updatePrice()` missing `MIN_PRICE` check allows seller to bypass minimum price enforcement

Author Revealed upon completion

NFTDealers::updatePrice() missing MIN_PRICE check allows seller to bypass minimum price enforcement

Description

`NFTDealers::updatePrice()` only validates that `_newPrice > 0`, while `NFTDealers::list()` enforces `_price >= MIN_PRICE` (1 USDC). This inconsistency allows a seller to first create a valid listing meeting the minimum price requirement, then immediately update the price to any value above zero — effectively bypassing the `MIN_PRICE` invariant entirely.

function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted {
require(_price >= MIN_PRICE, "Price must be at least 1 USDC"); //* inforced here
}
​
function updatePrice(uint256 _listingId, uint32 _newPrice) external onlySeller(_listingId) {
require(_newPrice > 0, "Price must be greater than 0"); // @> MIN_PRICE not enforced
}
​

Risk

Sellers can list NFTs at 1 wei USDC after initial listing, effectively gifting NFTs or manipulating the marketplace below the protocol's intended minimum price floor.

Likelihood: HIGH

  • Whitelisted address miint first, and listing, then updatePrice to below MIN_PRICE

Impact: HIGH

  • Violating protocol rules that MIN_PRICE must be minimal 1e6

Proof of Concept

1. Seller calls `NFTDealers::list(tokenId, 1e6)` — passes `MIN_PRICE` check

2. Seller immediately calls `NFTDealers::updatePrice(listingId, 1)` — sets price to 1 wei

3. Buyer calls `NFTDealers::buy()` — purchases NFT for 1 wei USDC

function test_updatePriceMinPrice() public whitelisted revealed {
vm.startPrank(userWithCash);
usdc.approve(address(nftDealers), type(uint256).max);
​
nftDealers.mintNft();
​
nftDealers.list(1, 100e6);
​
nftDealers.updatePrice(1, 1);
}

Recommended Mitigation

Apply the same `MIN_PRICE` validation in `NFTDealers::updatePrice()`:

function updatePrice(uint256 _listingId, uint32 _newPrice) external onlySeller(_listingId) {
+ require(_newPrice >= MIN_PRICE, "Price must be at least 1 USDC");
// ...
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!