NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

Listing stored by tokenId but event emits listingsCounter

Author Revealed upon completion

Root + Impact

Description

  • list() stores the listing in s_listings[_tokenId] but the emitted event
    uses listingsCounter. Off-chain systems (frontends, indexers) that use the
    event's listingId to call buy(), cancelListing(), or updatePrice() will
    reference wrong or nonexistent listings.

function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted {
listingsCounter++;
activeListingsCounter++;
​
@> s_listings[_tokenId] = Listing({...}); // stored at _tokenId
@> emit NFT_Dealers_Listed(msg.sender, listingsCounter); // emits counter
}

Risk

Likelihood:

  • Every listing emits a mismatched ID. Any integration
    relying on events will break.

Impact:

  • Users calling buy(listingsCounter) interact with the wrong
    listing or revert. Marketplace is functionally broken for off-chain consumers.

Proof of Concept

Token ID 5 creates listing stored at s_listings[5], but event emits
listingId = 1. A buyer calling buy(1) references s_listings[1] which is
a different (or empty) listing.

function test_listingIdMismatch() public {
// Mint token ID 1, then list it
vm.prank(alice);
nft.list(1, 50e6);
​
// Event emitted listingId = 1, storage key = tokenId 1
// These only match by coincidence when tokenId == listingsCounter
// Mint token 2, list it: stored at s_listings[2], event says listingId=2
// But if token 5 is listed: stored at s_listings[5], event says listingId=3
}

Recommended Mitigation

Use a consistent key. Either store at listingsCounter or emit _tokenId.

function list(uint256 _tokenId, uint32 _price) external onlyWhitelisted {
listingsCounter++;
activeListingsCounter++;
​
- s_listings[_tokenId] = Listing({...});
+ s_listings[listingsCounter] = Listing({...});
emit NFT_Dealers_Listed(msg.sender, listingsCounter);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!