ThunderNFT | IOP

Reports by Severity

Critical | High | Medium | Low | Insight

Critical

• IOP _ ThunderNFT 34534 - [Smart Contract - Critical] Maker will always only get token even if specifying a higher amount

• IOP _ ThunderNFT 34560 - [Smart Contract - Critical] Updating sell-maker-orders does not provide refunds

• IOP _ ThunderNFT 34605 - [Smart Contract - Critical] ERC tokens can be stolen because the amount is not validated in the update_order function

• IOP _ ThunderNFT 34629 - [Smart Contract - Critical] Theft of Deposited Funds

• IOP _ ThunderNFT 34630 - [Smart Contract - Critical] Incorrect Token Sale Amount

• IOP _ ThunderNFT 34636 - [Smart Contract - Critical] The amount is set to when creating the ExecutionResult which causes only NFT to be sold even if there should actually be more

• IOP _ ThunderNFT 34736 - [Smart Contract - Critical] ERC tokens are stuck on the contract if more than supplied for Sell order

• IOP _ ThunderNFT 34800 - [Smart Contract - Critical] Improper input validation in order update function leads to potential asset loss

• IOP _ ThunderNFT 34930 - [Smart Contract - Critical] User can only trade token when ERC is used

• IOP _ ThunderNFT 34934 - [Smart Contract - Critical] thunder_exchangeupdate_order can be abused to steal ERC token

• IOP _ ThunderNFT 34949 - [Smart Contract - Critical] Missing proper validation when updating order

• IOP _ ThunderNFT 34955 - [Smart Contract - Critical] Nfts of type may be stolen by updating an orders amount and cancelling it

• IOP _ ThunderNFT 34957 - [Smart Contract - Critical] executionResults always returns an amount of leading to stuck nfts

• IOP _ ThunderNFT 34958 - [Smart Contract - Critical] Incorrect Setting of Amount in ExecutionResult

• IOP _ ThunderNFT 34980 - [Smart Contract - Critical] Order side manipulation can lead to theft of NFTs

High

• IOP _ ThunderNFT 34496 - [Smart Contract - High] Users cant withdraw their funds for removed assets

• IOP _ ThunderNFT 34519 - [Smart Contract - High] users cant withdraw their tokens when specific asset removed from the whitelist

• IOP _ ThunderNFT 34565 - [Smart Contract - High] Selling maker cant cancel to retrieve his funds when strategy got removed

• IOP _ ThunderNFT 34585 - [Smart Contract - High] Permanent freezing of NFTS that seller deposit into thunder exchange when the strategy whitelist address updated

• IOP _ ThunderNFT 34587 - [Smart Contract - High] Users might temporarily get their funds locked in Pool contract

• IOP _ ThunderNFT 34642 - [Smart Contract - High] strategy de-listing causes sellers NFTs locked on ThunderExchange

• IOP _ ThunderNFT 34816 - [Smart Contract - High] users cant call update_order to update the strategy which prevent the NFT to be canceled or executed

• IOP _ ThunderNFT 34943 - [Smart Contract - High] User cant withdraw asset from pool after asset_managerremove_asset is called

• IOP _ ThunderNFT 34966 - [Smart Contract - High] Royalty or protocol fee of will DoS executing orders in ThunderExchange

Medium

• IOP _ ThunderNFT 34567 - [Smart Contract - Medium] users with current bid order can not update their order when payment token changed

• IOP _ ThunderNFT 34714 - [Smart Contract - Medium] owner of NFT who have sell orderlisting NFT can not accept any bid offers

Low

• IOP _ ThunderNFT 34455 - [Smart Contract - Low] Double Token Vulnerability leads to drain funds

• IOP _ ThunderNFT 34522 - [Smart Contract - Low] Self-transfer would inflate the balance

• IOP _ ThunderNFT 34545 - [Smart Contract - Low] Smart contract can be taken over by malicious user by back-running deployment

• IOP _ ThunderNFT 34659 - [Smart Contract - Low] Pool Balance Inflation

• IOP _ ThunderNFT 34702 - [Smart Contract - Low] the function register_royalty_info does not allow to be called by the admin when the owner exist

• IOP _ ThunderNFT 34760 - [Smart Contract - Low] Off-by-one error in get_supported_asset

• IOP _ ThunderNFT 34761 - [Smart Contract - Low] Off-by-one error in get_whitelisted_strategy

• IOP _ ThunderNFT 34791 - [Smart Contract - Low] Incompatibility with SRC might lead to inability of royalty info registrations

• IOP _ ThunderNFT 34839 - [Smart Contract - Low] Royalty Fee limit is not enforced for registered collections

• IOP _ ThunderNFT 34848 - [Smart Contract - Low] Incorrect verification of deposit asset leads to creation of in-executable orders

• IOP _ ThunderNFT 34906 - [Smart Contract - Low] Existing Sell order can be executed despite payment asset delisting

• IOP _ ThunderNFT 34962 - [Smart Contract - Low] tranfer_from function have critical issue which lead to double increase same address amount

• IOP _ ThunderNFT 34964 - [Smart Contract - Low] Faulty Index out of Bounds

• IOP _ ThunderNFT 34973 - [Smart Contract - Low] royalty_managerregister_royalty_info might not work in some case

• IOP _ ThunderNFT 34975 - [Smart Contract - Low] Read out of index

Insight

• IOP _ ThunderNFT 34542 - [Smart Contract - Insight] Not Handling Balance Entries Properly in the Withdraw Function

• IOP _ ThunderNFT 34578 - [Smart Contract - Insight] unds Not Locked During Order Placement

• IOP _ ThunderNFT 34677 - [Smart Contract - Insight] NFTs can not be canceled since the cancel_order function in thunder_exchange have read storage attribute which calls cancel_order in strategy that have write storage attribute

• IOP _ ThunderNFT 34963 - [Smart Contract - Insight] Invalid orders persist in storage maps with no indication of their invalid status

• IOP _ ThunderNFT 34967 - [Smart Contract - Insight] Insights Report

Reports by Type

Smart Contract

Smart Contract

• IOP _ ThunderNFT 34455 - [Smart Contract - Low] Double Token Vulnerability leads to drain funds
• IOP _ ThunderNFT 34496 - [Smart Contract - High] Users cant withdraw their funds for removed assets
• IOP _ ThunderNFT 34519 - [Smart Contract - High] users cant withdraw their tokens when specific asset removed from the whitelist
• IOP _ ThunderNFT 34522 - [Smart Contract - Low] Self-transfer would inflate the balance
• IOP _ ThunderNFT 34534 - [Smart Contract - Critical] Maker will always only get token even if specifying a higher amount
• IOP _ ThunderNFT 34542 - [Smart Contract - Insight] Not Handling Balance Entries Properly in the Withdraw Function
• IOP _ ThunderNFT 34545 - [Smart Contract - Low] Smart contract can be taken over by malicious user by back-running deployment
• IOP _ ThunderNFT 34560 - [Smart Contract - Critical] Updating sell-maker-orders does not provide refunds
• IOP _ ThunderNFT 34565 - [Smart Contract - High] Selling maker cant cancel to retrieve his funds when strategy got removed
• IOP _ ThunderNFT 34567 - [Smart Contract - Medium] users with current bid order can not update their order when payment token changed
• IOP _ ThunderNFT 34578 - [Smart Contract - Insight] unds Not Locked During Order Placement
• IOP _ ThunderNFT 34585 - [Smart Contract - High] Permanent freezing of NFTS that seller deposit into thunder exchange when the strategy whitelist address updated
• IOP _ ThunderNFT 34587 - [Smart Contract - High] Users might temporarily get their funds locked in Pool contract
• IOP _ ThunderNFT 34605 - [Smart Contract - Critical] ERC tokens can be stolen because the amount is not validated in the update_order function
• IOP _ ThunderNFT 34629 - [Smart Contract - Critical] Theft of Deposited Funds
• IOP _ ThunderNFT 34630 - [Smart Contract - Critical] Incorrect Token Sale Amount
• IOP _ ThunderNFT 34636 - [Smart Contract - Critical] The amount is set to when creating the ExecutionResult which causes only NFT to be sold even if there should actually be more
• IOP _ ThunderNFT 34642 - [Smart Contract - High] strategy de-listing causes sellers NFTs locked on ThunderExchange
• IOP _ ThunderNFT 34659 - [Smart Contract - Low] Pool Balance Inflation
• IOP _ ThunderNFT 34677 - [Smart Contract - Insight] NFTs can not be canceled since the cancel_order function in thunder_exchange have read storage attribute which calls cancel_order in strategy that have write storage attribute
• IOP _ ThunderNFT 34702 - [Smart Contract - Low] the function register_royalty_info does not allow to be called by the admin when the owner exist
• IOP _ ThunderNFT 34714 - [Smart Contract - Medium] owner of NFT who have sell orderlisting NFT can not accept any bid offers
• IOP _ ThunderNFT 34736 - [Smart Contract - Critical] ERC tokens are stuck on the contract if more than supplied for Sell order
• IOP _ ThunderNFT 34760 - [Smart Contract - Low] Off-by-one error in get_supported_asset
• IOP _ ThunderNFT 34761 - [Smart Contract - Low] Off-by-one error in get_whitelisted_strategy
• IOP _ ThunderNFT 34791 - [Smart Contract - Low] Incompatibility with SRC might lead to inability of royalty info registrations
• IOP _ ThunderNFT 34800 - [Smart Contract - Critical] Improper input validation in order update function leads to potential asset loss
• IOP _ ThunderNFT 34816 - [Smart Contract - High] users cant call update_order to update the strategy which prevent the NFT to be canceled or executed
• IOP _ ThunderNFT 34839 - [Smart Contract - Low] Royalty Fee limit is not enforced for registered collections
• IOP _ ThunderNFT 34848 - [Smart Contract - Low] Incorrect verification of deposit asset leads to creation of in-executable orders
• IOP _ ThunderNFT 34906 - [Smart Contract - Low] Existing Sell order can be executed despite payment asset delisting
• IOP _ ThunderNFT 34930 - [Smart Contract - Critical] User can only trade token when ERC is used
• IOP _ ThunderNFT 34934 - [Smart Contract - Critical] thunder_exchangeupdate_order can be abused to steal ERC token
• IOP _ ThunderNFT 34943 - [Smart Contract - High] User cant withdraw asset from pool after asset_managerremove_asset is called
• IOP _ ThunderNFT 34949 - [Smart Contract - Critical] Missing proper validation when updating order
• IOP _ ThunderNFT 34955 - [Smart Contract - Critical] Nfts of type may be stolen by updating an orders amount and cancelling it
• IOP _ ThunderNFT 34957 - [Smart Contract - Critical] executionResults always returns an amount of leading to stuck nfts
• IOP _ ThunderNFT 34958 - [Smart Contract - Critical] Incorrect Setting of Amount in ExecutionResult
• IOP _ ThunderNFT 34962 - [Smart Contract - Low] tranfer_from function have critical issue which lead to double increase same address amount
• IOP _ ThunderNFT 34963 - [Smart Contract - Insight] Invalid orders persist in storage maps with no indication of their invalid status
• IOP _ ThunderNFT 34964 - [Smart Contract - Low] Faulty Index out of Bounds
• IOP _ ThunderNFT 34966 - [Smart Contract - High] Royalty or protocol fee of will DoS executing orders in ThunderExchange
• IOP _ ThunderNFT 34967 - [Smart Contract - Insight] Insights Report
• IOP _ ThunderNFT 34973 - [Smart Contract - Low] royalty_managerregister_royalty_info might not work in some case
• IOP _ ThunderNFT 34975 - [Smart Contract - Low] Read out of index
• IOP _ ThunderNFT 34980 - [Smart Contract - Critical] Order side manipulation can lead to theft of NFTs