BogoCvetkov
commented
2 months ago Valid! Already submitted by another auditor -> https://github.com/Egis-Security/CTF_Challenge/issues/22
Open mo-hak opened 2 months ago
BogoCvetkov
commented
2 months ago Valid! Already submitted by another auditor -> https://github.com/Egis-Security/CTF_Challenge/issues/22
๐ฆ๐ฒ๐๐ฒ๐ฟ๐ถ๐๐:
Medium
Description of the Bug:
mapping(address => uint256) public deposits;When a user deposits ETH and receives an NFT, the ๐๐๐ฉ๐จ๐ฌ๐ข๐ญ๐ฌ ๐ฆ๐๐ฉ๐ฉ๐ข๐ง๐ is updated to reflect the deposited amount mapped to the initial depositor. However, if the NFT is transferred to another address via ๐ญ๐ซ๐๐ง๐ฌ๐๐๐ซ ๐๐ฎ๐ง๐๐ญ๐ข๐จ๐ง from erc721 (as it is not overridden), ๐ญ๐ก๐ ๐๐๐ฉ๐จ๐ฌ๐ข๐ญ๐ฌ ๐ฆ๐๐ฉ๐ฉ๐ข๐ง๐ ๐ข๐ฌ ๐ง๐จ๐ญ ๐ฎ๐ฉ๐๐๐ญ๐๐ ๐ญ๐จ ๐ซ๐๐๐ฅ๐๐๐ญ ๐ญ๐ก๐ข๐ฌ ๐ญ๐ซ๐๐ง๐ฌ๐๐๐ซ ๐ญ๐จ ๐ญ๐ก๐ ๐ง๐๐ฐ ๐จ๐ฐ๐ง๐๐ซ. This allows the new owner of the NFT to withdraw ETH without having deposited any, leading to unauthorized withdrawals.Impact:
Underflow Errors: Subtracting the deposit amount from an address with zero balance could cause underflow errors, leading to unexpected behavior or contract failure. And the original owner cant also withdraw as it is not the current owner. This would lead to ๐๐๐ง๐ข๐๐ฅ ๐จ๐ ๐ฌ๐๐ซ๐ฏ๐ข๐๐
Solution:
To prevent the vulnerability, the contract should be modified to ensure that only the original depositor can withdraw their ETH. This can be achieved by tracking the original depositor for each token ID and ensuring that only this address can call the withdraw function.