Submitted by gpersoon
Within RCMarket.sol the functions ownerOf and onlyTokenOwner do not check if the _cardId/_token is smaller than numberOfCards. So its possible to supply a larger number and access cards of other markets.
The most problematic seems to be upgradeCard. Here the check for isMarketApproved can be circumvented by trying to move the card via another market.
You can still only move cards you own.
Recommend adding the following to ownerOf:
require(_card < numberOfCards, "Card does not exist");
Splidge (Reality Cards) confirmed but recommended higher severity:
mcplums (Reality Cards) confirmed:
Splidge (Reality Cards) resolved:
dmvt (Judge) commented:
