search

code-423n4 / 2022-04-jpegd-findings

1 stars 1 forks source link

Owner can lock NFT infinitely #176

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/lock/JPEGLock.sol#L39

Vulnerability details

Impact

During the code review, It has been observed that owner can lock NFT infinitely. We are recommending to handle the NFT locks with DAO roles carefully to avoid any potential hack.

Proof of Concept

  1. Navigate to the following contract.

https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/lock/JPEGLock.sol#L39

  1. LockTime does not have any upper bound. Owner can lock infitely.

Tools Used

Code Review

Recommended Mitigation Steps

Consider implementing upper bound on the NFT lock time.

dmvt commented 2 years ago

Out of scope