ImmunefiEditor

$url = $_GET['url'];
$cmd = shell_exec("ping " . $url);
echo $cmd;

ImmunefiEditor

#[test(should_revert)] // Change to #[test()] once the codebase is updated
fn test_attack() {
    initialize_contracts();
    execute_attack();
}

fn initialize_contracts() {
    // Initialize contracts
    let thunder_exch = abi(ThunderExchange, thunder_exchange::CONTRACT_ID);
    let asset_mngr = abi(AssetManager, asset_manager::CONTRACT_ID);

ImmunefiEditor

#[storage(read), payable] //@audit seller is forced to send the NFT which doesn't exist for the user instead its in the thunder exchange itself when place_order called
fn _execute_sell_taker_order(order: TakerOrder) {
    let strategy = abi(ExecutionStrategy, order.strategy.bits());
    let execution_result = strategy.execute_order(order);
    require(execution_result.is_executable, ThunderExchangeErrors::ExecutionInvalid);
    require(
        msg_asset_id() == AssetId::new(execution_result.collection, execution_result.token_id), //@audit
        ThunderExchangeErrors::PaymentAssetMismatched
    ); // but the seller does not have the NFT ?
    require(msg_amount() == execution_result.amount, ThunderExchangeErrors::AmountMismatched);

ImmunefiEditor

 fn place_order(order_input: MakerOrderInput) {
        _validate_maker_order_input(order_input); // sanity checks 

        let strategy = abi(ExecutionStrategy, order_input.strategy.bits());
        let order = MakerOrder::new(order_input);

        match order.side {
            Side::Buy => { //users make offer for specific nft(bid)
                // Buy MakerOrder (e.g. make offer)
                // Checks if user has enough bid balance

ImmunefiEditor

#[test]
fn test_attack() {
    initialize_contracts();
    execute_attack();
}

fn initialize_contracts() {
    let thunder_exch = abi(ThunderExchange, thunder_exchange::CONTRACT_ID);
    thunder_exch.initialize();

ImmunefiEditor

pub fn s1(maker_order: MakerOrder, taker_order: TakerOrder) -> ExecutionResult {
    ExecutionResult {
        ...
        amount: 1,
        ...
    }

ImmunefiEditor

fn _execute_sell_taker_order(order: TakerOrder) {
    ...
    require(msg_amount() == execution_result.amount, ThunderExchangeErrors::AmountMismatched);

ImmunefiEditor

pub struct MakerOrder {
    ...
    pub amount: u64,

ImmunefiEditor

it("should prevent NFT theft via order update and cancellation", async () => {
  const nftId = 20, price = 1000000;

  // Step 1: NFT owner places a sell order
  expect(
    (await Exchange.placeSellOrder(exchange.id.toString(), provider.url, nft_owner.privateKey, {
      maker: nft_owner.address.toB256(),
      collection: erc721.id.toB256(),
      tokenId: nftId,
      price,

ImmunefiEditor

fn cancel_order(strategy: ContractId, nonce: u64, side: Side) {
    // ...
    let order = strategy_caller.get_maker_order_of_user(caller, nonce, side);
    match side {
        Side::Sell => {
            if (order.is_some()) {
                // ... (cancel order in strategy)
                transfer(                                                           
                    Identity::Address(unwrapped_order.maker),
                    AssetId::new(unwrapped_order.collection, unwrapped_order.token_id),