NFJLabs security record

The bid function takes two parameters; the nft token id and the amount a bidder is willing to bid. While this function does proper checks that encompasses knowing if a bidder had made a bid before, reverts when seller attempts to bid on their own auctioned nfts, check when an auction has started and the auction time interval. However, there are three parameters to pay attention to, to understand how funds are lost in contract. These parameters are _payAmount, totalAmountUserPay, and itemActualPrice - amount being sent into the contract by the bidder, amount derived from the getNFTFinalRate() function, and amount derived from dividing the result of _payAmount multiply by the max basis point (MAX_BPS)  by the result of the addition of the MAX_BPS and platformFee. While the value of itemActualPrice aids in ensuring that the new bidder makes a bid greater than the last bidder, other values ensure that _payAmount exceeds totalAmountUserPay.

Tokens put up for auction can only be cancelled at any time, even when the auction timer is over. The token owner would not be the recipient of the NFT if the platformOwner calls cancelAuction() before they can. The platformOwner can take ownership of tokens this way.

During compilation, the codebase breaks at the level of the _beforeTokenTransfer hook and this makes it impossible to deploy the contract. Moreso, it was discovered that the hook was not implemented the proper way. The primary motive of the hook is to allow developers to make additional code implementation on what could happen before the move of the tokens from one address to another.Although the override feature was added to the function and the whenNotPaused modifier from PausableUpgradable.sol, the override was not effective as the compiler throws an error of “function has override specified, it does not override anything”. This implies that the modification on the beforeTokenTransfer function can be effective when it is implemented within it. Also, parameters being passed to the super._beforeTokenTransfer expected four parameters but got three.

The marketplace contract allows nfts holders to put nft items for auctioning and for sales. When any nft item is put on sale by the token holder, it is not possible for the token owner to remove these nfts again even with the removeFromSale function unless purchased. The removeFromSale function has a line of code that disallows removal from contract after putting on sale.

The require check on L98 is unnecessary because the zero address can’t be used to sign transactions.