1

So I'm implementing a NFT marketplace. It allows a non custodial bidding system; Meaning an address can make a bid (provided it has enough fund at the moment of bidding) without sending the funds. To do that I'm using an ERC20 (WETH).

So when the NFT seller accepts a bid, with acceptOffer it sends the NFT to the bidder and then transfer the funds with ERC20.transferFrom from the bidder to the seller (and an other one from the bidder to the contract for the fees).

bool sent1 = ERC20(WETH).transferFrom(
        order.offers[index].bidder,
        msg.sender,
        afterFees
    );
    if (!sent1) revert failedToSendEther();

    bool sent2 = ERC20(WETH).transferFrom(
        order.offers[index].bidder,
        address(this),
        (offer.offerPrice * marketPlaceFee) / 100
    );
    if (!sent2) revert failedToSendEther();

However Slither then detects a high risk vulnerability: slither message

github vulnerability description

Isn't the point of transferFrom actually to be able to transfer not from message sender with the required allowance ?

Is it truly a high vulnerability ? I don't see where it could be a risk since the bidder is the one that made the offer, that they have only approved the contract and the amount is sent from them to the owner of the NFT:

    Offer memory tempO = Offer({
        bidder: msg.sender, 
        offerTime: block.timestamp, 
        offerPrice: amount, 
        duration: duration});
        
    marketOffers[marketOfferId].offers.push(tempO);

Is it truly a possible attack vector ? Is there an other way to do it ? If not is there a way to stop slither's warning ?

here is the full code: github

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.