finish up contract audit comments

This commit is contained in:
han 2025-01-19 17:22:25 +07:00
parent 50370b5b0c
commit 7d438f1c44

View File

@ -223,19 +223,24 @@ contract TokenDivider is IERC721Receiver, Ownable {
revert TokenDivider__AmountCantBeZero();
}
// @audit: no check for 0 price?
ERC20Info memory tokenInfo = nftToErc20Info[nftPegged];
if (balances[msg.sender][tokenInfo.erc20Address] < amount) {
revert TokenDivider__InsuficientBalance();
}
balances[msg.sender][tokenInfo.erc20Address] -= amount;
balances[msg.sender][tokenInfo.erc20Address] -= amount; // token amount reduced from its holder on sell order even tho no one buy it
// push sell order to array of sender
s_userToSellOrders[msg.sender].push(
SellOrder({seller: msg.sender, erc20Address: tokenInfo.erc20Address, price: price, amount: amount})
);
emit OrderPublished(amount, msg.sender, nftPegged);
// send erc20 token from owner to this contract
// @audit: what if the owner of ERC20 rejected this transaction?
IERC20(tokenInfo.erc20Address).transferFrom(msg.sender, address(this), amount);
}
@ -254,19 +259,24 @@ contract TokenDivider is IERC721Receiver, Ownable {
SellOrder memory order = s_userToSellOrders[seller][orderIndex];
// msg.value can be greater than order price?
if (msg.value < order.price) {
revert TokenDivider__IncorrectEtherAmount();
}
// if price 100, then fee is 1
uint256 fee = order.price / 100;
// if price 100, then seller fee is 0.5
uint256 sellerFee = fee / 2;
if (msg.value < order.price + sellerFee) {
revert TokenDivider__InsuficientEtherForFees();
}
// record erc20 amount on storage variable onchain
balances[msg.sender][order.erc20Address] += order.amount;
// override the current orderIndex with tail, then pop the tail out of array
s_userToSellOrders[seller][orderIndex] = s_userToSellOrders[seller][s_userToSellOrders[seller].length - 1];
s_userToSellOrders[seller].pop();
@ -274,18 +284,23 @@ contract TokenDivider is IERC721Receiver, Ownable {
// Transfer The Ether
// send ether to seller, reduced with seller fee
(bool success,) = payable(order.seller).call{value: (order.price - sellerFee)}("");
if (!success) {
revert TokenDivider__TransferFailed();
}
// send "fee" to "owner"?
// @audit: if buyer needs to pay price + seller fee. then seller is given price - seller fee. does fee is guarranted to be paid by buyer?
// @audit: who owner?
(bool taxSuccess,) = payable(owner()).call{value: fee}("");
if (!taxSuccess) {
revert TokenDivider__TransferFailed();
}
// send erc20 token to buyer address
IERC20(order.erc20Address).transfer(msg.sender, order.amount);
}