NFT Dealers

First Flight #58
Beginner FriendlyFoundry
100 EXP
Submission Details
Impact: medium
Likelihood: high

Only whitelisted users can list NFTs, contrary to README

Author Revealed upon completion

Only whitelisted users can list NFTs, contrary to README

Description

According to the README:

Actors:

  1. Owner

  • deploy the smart contract and set parameters (collateral, collection name, image, symbol, etc.)

  • whitelist or remove from whitelist wallets

  • reveal the protocol

  • withdraw fees

  1. Whitelisted user/wallet

  • mint NFT

  • buy, update price, cancel listing, list NFT

  • collect USDC after selling

  1. Non whitelisted user/wallet

  • cannot mint

  • buy, update price, cancel listing, list NFT

  • collect USDC after selling

However, in the code:

// Root cause in the codebase with @> marks to highlight the relevant section
function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted { ... }

So only whitelisted users can list NFTs.

Risk

Impact:

  • Code and docs are inconsistent

Recommended Mitigation

Open up the listfunction to all users.

- function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted { ... }
+ function list(uint256 _tokenId, uint32 _price) external { ... }

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!