Foundation contest - csanuragjain's results

Stuck Seller NFT

1. In placeBidOf function at NFTMarketReserveAuction.sol#L386, attacker can keep on extending the auction time and hence seller nft would stuck
2. User A places his NFT for Auction with price 1
3. Malicious User B who dont want this NFT to be sold, simply places bid on this NFT for say amount 1
4. Once auction is nearing the end, User B immediately places another bid of amount 1+10% which increases auction time by extensionDuration (15 min) and releases amount from step 3
5. User B keeps on repeating Step 4 once extensionDuration is near to end (14 minutes) using bot
6. Since auction cannot end due to continuos bid and there is no way seller can force close auction, seller nft gets stuck
7. Only way left for seller is to contact Admin and make him call adminCancelReserveAuction function which will not be easy task

Note: This attack only works if initial amount set by seller is low

Migrate auctions which were not authorized by seller

1. In adminAccountMigration function at NFTMarketReserveAuction.sol#L263, Since Auction id is independent of signature, FoundationOperator can provide an auction id which seller has not authorized the foundation operator
2. User A requested foundation operator to change address for auction id 1
3. foundation operator calls adminAccountMigration and instead of just passing auction id 1 he also passes auction id 2 owned by user A
4. Since signature is independent of account id, so migration gets success

Bypass 24 hour sale window

1. The buyFromPrivateSaleFor function at NFTMarketPrivateSale.sol#L123 checks whether sale has expired (24-25 hours passed) or not
2. Assume User A started sale with deadline of 5 days instead of 1 day
3. buyFromPrivateSaleFor is called on 4th day
4. deadline > block.timestamp + 2 days is checked which returns false since 5 days > 4+2 days which is false and hence NFTMarketPrivateSale_Can_Be_Offered_For_24Hrs_Max is bypassed

Recommendation: Instead of using block.timestamp + 2 days, use the date when signature was requested

Sanity checks missing

1. In adminCancelOffers function at NFTMarketOffer.sol#L150, make sure to check if nftContracts.length=tokenIds.length

require(nftContracts.length==tokenIds.length, "Incorrect Input");

2. The depositFor function at FETH.sol#L232 should add a check to see account!=address(0), otherwise user can mistakenly send money to zero (burn) address

require(account!=address(0), "Invalid address");

approve could be frontrun

1. The approve function in FETH.sol could be frontrun

1. In buyFromPrivateSaleFor function at NFTMarketPrivateSale.sol#L180, _distributeFunds function is called and returned variable are stored in (uint256 f8nFee, uint256 creatorFee, uint256 ownerRev). However none of these variables are actually used. Recommendation would be to just call _distributeFunds function without storing any returned value from the function

2. In _getCreatorPaymentInfo function at NFTMarketCreators.sol#L49, observe that code at L90-L106 is similar to L153-L166. An ideal way would be to create a function of the recurring code and then call these functions without rewriting them multiple times

3. In _transferFromEscrow function at NFTMarketOffer.sol#L296, use memory instead of storage in below line:

Offer storage offer = nftContractToIdToOffer[nftContract][tokenId];

4. In _cancelBuyersOffer function at NFTMarketOffer.sol#L326, use memory instead of storage in below line:

Offer storage offer = nftContractToIdToOffer[nftContract][tokenId];