search

code-423n4 / 2021-05-nftx-findings

1 stars 0 forks source link

Vault's flash loan not implemented according to EIP-3156 #54

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

@cmichelio

Vulnerability details

Vulnerability Details

The NFTXVaultUpgradeable.flashLoan is not correctly implemented according to EIP-3156 (but it tries to implement it as it inherits from IERC3156FlashLenderUpgradeable).

"If successful, flashLoan MUST return true." - https://eips.ethereum.org/EIPS/eip-3156

It misses the return and currently always returns false.

Impact

Always returning false indicates that the flash loan was unsuccessful when in reality it could have been successful. This breaks any contract trying to integrate with it.

Recommended Mitigation Steps

Add the return statement: return super.flashLoan(...)

cemozerr commented 3 years ago

Keeping this as low-risk as flash loan returning the project does not pose a security threat for the NFTX project itself