Skip to content

Latest commit

 

History

History
236 lines (135 loc) · 6.31 KB

report.md

File metadata and controls

236 lines (135 loc) · 6.31 KB

Aderyn Analysis Report

This report was generated by Aderyn, a static analysis tool built by Cyfrin, a blockchain security company. This report is not a substitute for manual audit or security review. It should not be relied upon for any purpose other than to assist in the identification of potential security vulnerabilities.

Table of Contents

Summary

Files Summary

Key Value
.sol Files 2
Total nSLOC 186

Files Details

Filepath nSLOC
src/AuctionContract.sol 168
src/SellerNft.sol 18
Total 186

Issue Summary

Category No. of Issues
High 2
Low 5

High Issues

H-1: Uninitialized State Variables

Solidity does initialize variables by default when you declare them, however it's good practice to explicitly declare an initial value. For example, if you transfer money to an address we must make sure that the address has been initialized.

1 Found Instances

  • Found in src/SellerNft.sol Line: 11

         uint256 private tokenCounter;

H-2: Sending native Eth is not protected from these functions.

Introduce checks for msg.sender in the function

1 Found Instances

  • Found in src/AuctionContract.sol Line: 198

         function withdraw() public {

Low Issues

L-1: Centralization Risk for trusted owners

Contracts have owners with privileged rights to perform admin tasks and need to be trusted to not perform malicious updates or drain funds.

3 Found Instances

  • Found in src/AuctionContract.sol Line: 12

     contract AuctionContract is Ownable, ReentrancyGuard, IERC721Receiver {

  • Found in src/SellerNft.sol Line: 10

     contract SellerNFT is ERC721, Ownable {

  • Found in src/SellerNft.sol Line: 22

         function approveToAuction(address auctionContract, uint256 tokenId) external onlyOwner{

L-2: Unsafe ERC20 Operations should not be used

ERC20 functions may not behave as expected. For example: return values are not always meaningful. It is recommended to use OpenZeppelin's SafeERC20 library.

2 Found Instances

  • Found in src/AuctionContract.sol Line: 112

             nft.transferFrom(msg.sender, address(this), tokenId);

  • Found in src/AuctionContract.sol Line: 175

             payable(auction.seller).transfer(sellerEth);

L-3: public functions not used internally could be marked external

Instead of marking a function as public, consider marking it as external if it is not used internally.

5 Found Instances

  • Found in src/AuctionContract.sol Line: 133

         function bid(

  • Found in src/AuctionContract.sol Line: 162

         function sellerEndAuction(uint256 auctionId) public nonReentrant {

  • Found in src/AuctionContract.sol Line: 186

         function getActiveAuctions() public view returns (uint256[] memory) {

  • Found in src/AuctionContract.sol Line: 198

         function withdraw() public {

  • Found in src/AuctionContract.sol Line: 210

         function onERC721Received(

L-4: Event is missing indexed fields

Index event fields make the field more quickly accessible to off-chain tools that parse events. However, note that each index field costs extra gas during emission, so it's not necessarily best to index the maximum allowed per event (three fields). Each event should use three indexed fields if there are three or more fields, and gas usage is not particularly of concern for the events in question. If there are fewer than three fields, all of the fields should be indexed.

4 Found Instances

  • Found in src/AuctionContract.sol Line: 27

         event NFTDeposited(

  • Found in src/AuctionContract.sol Line: 32

         event BidPlaced(

  • Found in src/AuctionContract.sol Line: 37

         event AuctionEnded(

  • Found in src/AuctionContract.sol Line: 42

         event bidRefunded(

L-5: PUSH0 is not supported by all chains

Solc compiler version 0.8.20 switches the default target EVM version to Shanghai, which means that the generated bytecode will include PUSH0 opcodes. Be sure to select the appropriate EVM version in case you intend to deploy on a chain other than mainnet like L2 chains that may not support PUSH0, otherwise deployment of your contracts will fail.

2 Found Instances

  • Found in src/AuctionContract.sol Line: 3

     pragma solidity 0.8.20;

  • Found in src/SellerNft.sol Line: 3

     pragma solidity 0.8.20;