Sellers can sell nfts to buyers and burn/nuke the nfts after selling.

[c4-bot-4]

Lines of code

https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/TraitForgeNft/TraitForgeNft.sol#L143
https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/NukeFund/NukeFund.sol#L155

Vulnerability details

Impact

Any user can set his any address as approved i.e _tokenApprovals[tokenid] for a tokenid.then seller can sell the tokenid nft other users, after selling the nft, alice can burn/nuke the nft which is unfair/unintentional for the protocol.

Proof of Concept

1. Let’s assume, alice mint a tokenid in a generation.alice approves the tokenid to her own different address(account2) i.e alice updates _tokenApprovals[tokenid] = account2.

2. Now Alice lists the tokenid nft for sale by calling the function listNFTForSale.

3. Bob buys the tokenid nft by calling the function buyNFT.

4. Now alice calls function burn with account2, this burn function calls isApprovedOrOwner function,as account2 is approved for this tokenid, as a result, the tokenid nft is burned.alice can calls nuke function which calls isApprovedOrOwner function,as account2 is approved for this tokenid, as a result, the tokenid nft is nuked.

5. So alice can set herself as approved for this tokenid and alice can sell the tokenid nft other users, after selling the nft, alice can burn/nuke the nft which is unfair/unintentional for the protocol.

Tools Used

manual review

Recommended Mitigation Steps

Implement a mechanism so that sellers can’t burn/nuke the nft after selling the nft to other users.

Assessed type

Error

[Almur100]

Why this is invalid??
Similar issue was accepted in NextGen audit
code-423n4/2023-10-nextgen-findings#1597