Submitted by nnez, also found by Ch_301
This vulnerability allows malicious buyers to acquire listed NFTs without payment to sellers.
Users can list their tokens for sale by calling setlistosell and specifying a price and payment token (denom). Buyers can then purchase the token by calling setbidtobuy and transferring the payment into the contract.
The trade is finalized when transfer_nft is invoked and the recipient is the buyer. The caller can be the seller, or, if auto_approve is set to true, the caller can also be the buyer as theyre given approval upon calling setbidtobuy.
However, transfer_nft function lacks a proper validation during the transfer. This vulnerability stems from two key oversights:
These oversights enable malicious buyers to acquire NFTs without paying the listed price, effectively stealing them from sellers.
transfer_nft implementation:
This vulnerability can be exploited in two scenarios:
The following test demonstrates the two described scenarios:
Boilerplate for PoC here.
If token is listed for sell, check that the offer bid amount is exactly matched with the listed price set by seller.
Invalid Validation
blockchainstar12 (Coded Estate) confirmed
