Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding sails marketplace contract #513

Open
wants to merge 11 commits into
base: master
Choose a base branch
from

Conversation

MedovTimur
Copy link
Contributor

No description provided.

Copy link
Contributor

@LouiseMedova LouiseMedova left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are potential vulnerabilities that arise from interactions between a marketplace contract and token contracts. For example:

  1. Scenario 1 (NFT transferred first):
  • A buyer makes an offer and transfers fungible tokens to the marketplace contract's balance.

  • The seller accepts the offer and sends a message to the contract. During the processing of this message: The NFT transfer is executed first, and the message is placed in a waitlist. Meanwhile, the buyer sends a withdraw message to cancel the offer and withdraws their tokens.

  • When the seller's message resumes processing, it fails at the point of transferring tokens from the buyer to the seller. However, the NFT has already been transferred to the buyer, leaving the seller without compensation.

  1. Scenario 2 (Tokens transferred first):
  • The seller accepts the offer and sends a message to the contract. During the processing of this message: The transfer of tokens from the buyer to the seller is executed first, and the message is placed in a waitlist.

  • Meanwhile, another buyer decides to purchase the NFT and sends a purchase message.

  • When the seller's message resumes processing, it fails during the NFT transfer. As a result: The seller receives double payment: one from the initial buyer's token transfer and another from the second buyer's purchase.The initial buyer ends up without their tokens and without the NFT.

contracts/nft-marketplace/app/src/nft_messages.rs Outdated Show resolved Hide resolved
contracts/nft-marketplace/app/src/nft_messages.rs Outdated Show resolved Hide resolved
contracts/nft-marketplace/app/src/funcs.rs Outdated Show resolved Hide resolved
contracts/nft-marketplace/app/src/funcs.rs Outdated Show resolved Hide resolved
contracts/nft-marketplace/app/src/funcs.rs Outdated Show resolved Hide resolved
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants