Diligence 5.5: Duplicate tokens will break award

pooltogether · Dec 1, 2020 · 243fa10 · 243fa10
1 parent 4791e39
commit 243fa10
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 3 deletions.
diff --git a/contracts/prize-strategy/PeriodicPrizeStrategy.sol b/contracts/prize-strategy/PeriodicPrizeStrategy.sol
@@ -510,14 +510,22 @@ abstract contract PeriodicPrizeStrategy is Initializable,
     }
 
     for (uint256 i = 0; i < _tokenIds.length; i++) {
-      uint256 tokenId = _tokenIds[i];
-      require(IERC721(_externalErc721).ownerOf(tokenId) == address(prizePool), "PeriodicPrizeStrategy/unavailable-token");
-      externalErc721TokenIds[_externalErc721].push(tokenId);
+      _addExternalErc721Award(_externalErc721, _tokenIds[i]);
     }
 
     emit ExternalErc721AwardAdded(_externalErc721, _tokenIds);
   }
 
+  function _addExternalErc721Award(address _externalErc721, uint256 _tokenId) internal {
+    require(IERC721(_externalErc721).ownerOf(_tokenId) == address(prizePool), "PeriodicPrizeStrategy/unavailable-token");
+    for (uint256 i = 0; i < externalErc721TokenIds[_externalErc721].length; i++) {
+      if (externalErc721TokenIds[_externalErc721][i] == _tokenId) {
+        revert("PeriodicPrizeStrategy/erc721-duplicate");
+      }
+    }
+    externalErc721TokenIds[_externalErc721].push(_tokenId);
+  }
+
   /// @notice Removes an external ERC721 token as an additional prize that can be awarded
   /// @dev Only the Prize-Strategy owner/creator can remove external tokens
   /// @param _externalErc721 The address of an ERC721 token to be removed

diff --git a/test/PeriodicPrizeStrategy.test.js b/test/PeriodicPrizeStrategy.test.js
@@ -361,6 +361,12 @@ describe('PeriodicPrizeStrategy', function() {
       await expect(prizeStrategy.connect(wallet2).addExternalErc721Award(externalERC721Award.address, [1]))
         .to.be.revertedWith('PeriodicPrizeStrategy/only-owner-or-listener')
     })
+
+    it('should not allow someone to add a token twice', async () => {
+      await externalERC721Award.mock.ownerOf.withArgs(1).returns(prizePool.address)
+      await expect(prizeStrategy.addExternalErc721Award(externalERC721Award.address, [1, 1]))
+        .to.be.revertedWith('PeriodicPrizeStrategy/erc721-duplicate')
+    })
   })
 
   describe('removeExternalErc721Award()', () => {