Omniscia Seen Haus Audit

LotsTicketer Manual Review Findings

LotsTicketer Manual Review Findings

LTR-01M: Inexistent Ticket Cleanup

TypeSeverityLocation
Logical FaultMinorLotsTicketer.sol:L207

Description:

The claim function does not clear up the data entry of a ticket when it is burned.

Example:

contracts/market/client/ticketers/LotsTicketer.sol
191/**
192  * Claim the escrowed items associated with the ticket.
193  *
194  * @param _ticketId - the ticket representing the escrowed items
195  */
196function claim(uint256 _ticketId)
197external
198override
199{
200    require(_exists(_ticketId), "Invalid ticket id");
201    require(ownerOf(_ticketId) == msg.sender, "Caller not ticket holder");
202

203    // Get the MarketController
204    IMarketController marketController = getMarketController();
205

206    // Get the ticket
207    EscrowTicket memory ticket = tickets[_ticketId];
208

209    // Burn the ticket
210    _burn(_ticketId);
211

212    // Release the consignment to claimant
213    marketController.releaseConsignment(ticket.consignmentId, ticket.amount, msg.sender);
214

215    // Notify listeners of state change
216    emit TicketClaimed(_ticketId, msg.sender, ticket.amount);
217

218}

Recommendation:

We advise this to be done so to ensure proper data consistency across the system, similarly to how it is performed in the ItemsTicketer contract.

Alleviation:

The tickets data entry is now properly wiped via the delete operator.

Prev

AuctionRunnerFacet.sol (ARF-M)

Next

MarketHandlerBase.sol (MHB-M)

On this page