NFTonPulse

Quantstamp21 Jul 2023Files named in the report

Audit

Quantstamp reviewed NFTonPulse on 21 Jul 2023: 25 findings, 0 critical; 16 marked fixed, 6 acknowledged, 3 open.

No open critical findings

Open the report Open NFTonPulse’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings25

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	1
Medium	2	1	3
Low	0	5	12

MediumVouchers Can Be FrontrunAcknowledged

Redeeming vouchers only requires that the signature of the voucher matches that of the creator of the voucher. The address the NFT is sent to is completely independent of the voucher. Therefore, any voucher can be used to mint an NFT to any address. Since all of the voucher's data will be available to the mempool when calling `redeem()`, a malicious actor could use the voucher before the user who created and sent the transaction with the voucher. In the case of `NFT721`, the original user's transaction will fail due to the ID specified already having been used. `NFT1155` transactions may also fail if the frontrunner mints the full amount in the voucher. Vouchers for `NFT1155` may also be reused if the first transaction did not claim the full amount.

LowMistaken Bids Can Be Immediately AcceptedAcknowledged

If a user accidentally submits a bid that is larger than they desire, a sophisticated auction creator could accept the bid before the user can call `cancelBid()`.

LowNFTs and Funds Are Not Sent to the MarketplaceAcknowledged

The marketplace does not require items to be transferred to it, whenever they are being listed for sales. A lister can simply send the NFT elsewhere, and when a buyer tries to place a buy order, the transaction will revert, since the original owner doesn't own the NFT anymore. This can cause the marketplace to be flooded with invalid orders Which will damage its user experience and reputation. On the other hands, bidders are not required to send their funds to the marketplace. Which means that at the time when an item owner wants to accept their bid, the bidder might not have enough funds to cover the cost. This will also cause the transaction to revert.

LowOn-Transfer-Fee Tokens CompatibilityAcknowledged

Some ERC-20 tokens implement additional functionalities when are being transferred. Some of them subtract a fee in the transfer operation (i.e. when transferring 100 tokens, the receiver's balance will increase in 90 tokens, as 10 tokens were collected as fee).

LowTokens Removed From Whitelist Can Still Be Used to Fulfill Existing Offers/bidsAcknowledged

Only whitelisted tokens can be used to create bids and offers. However, if a token used to create a bid or offer is removed from the whitelist by the owner, the offer or bid can still be accepted. Calls to the removed token may be harmful.

LowWhitelisting too Many Tokens on Construction Will FailAcknowledged

A for loop is used to include tokens from a dynamic array in the whitelist. If there are too many tokens in the array, it is possible to run out of gas on deployment.