You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
No cost price submission due to lack of error checking
Hello, UnUniFi Project Party. Through a quick code read, I may have found a vulnerability in your project.
Introduction
In the following code content, the error handling of x.bankKeeper.SendCoins is missing, which will result in a malicious user being able to set the status without cost. https://github.com/UnUniFi/chain/blob/v3.1.0/app/app.go
No cost price submission due to lack of error checking
Hello, UnUniFi Project Party. Through a quick code read, I may have found a vulnerability in your project.
Introduction
In the following code content, the error handling of x.bankKeeper.SendCoins is missing, which will result in a malicious user being able to set the status without cost.
https://github.com/UnUniFi/chain/blob/v3.1.0/app/app.go
Impact
This vulnerability can lead to no-cost price submissions, ultimately resulting in almost $0 price for any nft
Related issue code
https://github.com/UnUniFi/chain/blob/v3.1.0/x/pricefeed/keeper/keeper.go#L49-L63
Issues that can be used for reference
ignite/cli#2828
Credit to
https://twitter.com/MaLucasBC
The text was updated successfully, but these errors were encountered: