NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

The seller can update the sale price of a listing to an amount lower than the `MIN_PRICE` constant.

Author Revealed upon completion

Root + Impact

Description

  • Evn though the minimum price is applied at the time of listing an NFT, the seller can update the price later to a price lower than the amount determined by the MIN_PRICE constant.


function updatePrice(
uint256 _listingId,
uint32 _newPrice
) external onlySeller(_listingId) {
Listing memory listing = s_listings[_listingId];
uint256 oldPrice = listing.price;
if (!listing.isActive) revert ListingNotActive(_listingId);
@> require(_newPrice > 0, "Price must be greater than 0");
​
s_listings[_listingId].price = _newPrice;
emit NFT_Dealers_Price_Updated(_listingId, oldPrice, _newPrice);
}
​

Risk

Likelihood: Medium

  • Due to the lack of checks, it is fairly possible to happen if the seller decides to change the price.


Impact: Medium

  • It breaks one of the invariants but does not have any catastrophic consequences.


Proof of Concept

Please add the following function to the test file and run it using test forge --mt testSellerCanUpdatePriceToLowerThanMinPrice.

function testSellerCanUpdatePriceToLowerThanMinPrice() public revealed {
uint256 tokenId = 1;
uint32 initialPrice = 10e6;
uint32 newPrice = 1; // Below the minimum price
​
mintAndListNFTForTesting(tokenId, initialPrice);
​
vm.startBroadcast(userWithCash);
nftDealers.updatePrice(1, newPrice);
vm.stopBroadcast();
}

Recommended Mitigation

To sole the issue just make the following changes.

function updatePrice(
uint256 _listingId,
uint32 _newPrice
) external onlySeller(_listingId) {
Listing memory listing = s_listings[_listingId];
uint256 oldPrice = listing.price;
if (!listing.isActive) revert ListingNotActive(_listingId);
- require(_newPrice > 0, "Price must be greater than 0");
+ require(_newPrice > MIN_PRICE, "Price must be greater than MIN_PRICE");
s_listings[_listingId].price = _newPrice;
emit NFT_Dealers_Price_Updated(_listingId, oldPrice, _newPrice);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!