The function settleWithBuyout() when transferring the triggerFee used safeTransfer() instead of safeTransferFrom(). As a result, it will use the fund from the contract to pay the fee instead of using the fund of buyer.
Mitigation
Changed from safeTransfer() to safeTransferFrom().
Lines of code
Vulnerability details
Issue
The function
settleWithBuyout()
when transferring thetriggerFee
usedsafeTransfer()
instead ofsafeTransferFrom()
. As a result, it will use the fund from the contract to pay the fee instead of using the fund of buyer.Mitigation
Changed from
safeTransfer()
tosafeTransferFrom()
.