search

code-423n4 / 2022-09-party-findings

2 stars 0 forks source link

Anyone could steal the funds #290

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/crowdfund/BuyCrowdfundBase.sol#L131

Vulnerability details

Impact

Anyone can create a contract. and send all the funds if maximumPrice == 0 or at the list he can get the maximumPrice

Proof of Concept

Create a contract to send the funds to it Invoke buy() on CollectionBuyCrowdfund.sol or BuyCrowdfund() And it will transfer all the funds to the malicious contract

Recommended Mitigation Steps

Add more checks for the callTarget

merklejerk commented 1 year ago

This is intentional. It's an arbitrary call to acquire the NFT, which is why we require that the party holds the NFT afterwards.

HardlyDifficult commented 1 year ago

By design - invalid.