search

code-423n4 / 2023-01-opensea-findings

0 stars 0 forks source link

No check for overflow or underflow of the uint256 values, which could allow for malicious actors to perform token or ether theft. #89

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/ProjectOpenSea/seaport/blob/5de7302bc773d9821ba4759e47fc981680911ea0/contracts/interfaces/AbridgedTokenInterfaces.sol#L4

Vulnerability details

Impact

A hacker contract is created that calls the "transferFrom" function in the ERC20Interface with a very large value for the "amount" parameter. Since the contract does not have proper overflow/underflow checks in place, it will process the transaction and transfer more tokens than it intended to, resulting in token or ether theft.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

0age commented 1 year ago

contested; external contracts are out of scope

c4-judge commented 1 year ago

HickupHH3 marked the issue as unsatisfactory: Insufficient quality