search

Egis-Security / CTF_Challenge

Repository containing CTF challenges from nmirchev8, deth and bOgO.
14 stars 8 forks source link

b0g0_ctf - locked ETH #22

Open sammy-tm opened 1 month ago

sammy-tm commented 1 month ago

Description

If a depositor transfers an NFT to another depositor, and the other depositor withdraws, the ETH from the first depositor gets locked in the contract forever.

Imagine this scenario :

D1 : Deposits and gets NFT 1 and transfers to D2 D2 : Deposits and gets NFT 2 D2 : Burns NFT 1

Now, deposits[D2] will be zero, so even if D2 burns NFT 2, he won't get his deposit back and there is no way to recover this ETH

Impact

Permanent loss of funds

X1pherW0lf commented 1 month ago

D2's NFT2 will be stuck as well since his deposit becomes 0 so only way to recover is to D2 sends NFT 2 to D1 and withdraw lol

BogoCvetkov commented 1 month ago

Good one! Valid - first submission for that issue

BogoCvetkov commented 1 month ago

I'm splitting this between this report and #23