Any one can mint penny NFT to take some advantage

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L389 https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L268

Vulnerability details

Any one can mint penny NFT to take some advantage

Impact

Some users might be taken advantage of, for those who long call or short put the floortoken, and finnally lead to loss of these users.

Proof of Concept

There is no control over the floortoken platform, which means everyone can mint some NFT at any price. When a long call comes out, anyone can mint some NFTs and set the price to 0.0000001 ETH, and then fill the long call order to collect the premium. Or in the case of short put order, anyone can come up with some penny NFTs to

Since the contract does not allow creating short call for floortoken order, in symmetry, the long call side should also be restricted.

Tools Used

Mannual analysis.

Recommended Mitigation Steps

Resitrict the short call order of floortoken, add some requirements for the floortokens. Or just like the long call side, completely disallow the orders.

[outdoteth]

Attack does not make sense. If I understand correctly, it says that anyone can create options on any NFT, including very cheap NFTs. That is not an issue.

[HickupHH3]

Yeah, it's up to the user to decide if he wants to fill the order and pay the premium for the option.