NEAR Protocol (NEAR)

🪲 NEAR 스마트 계약에서 버그 찾기

2022년 실제 NEAR 펀지 토큰의 핵심 파일입니다

평판 좋은 보안 업체가 감사를 진행했으며 `ft` 관련 함수가 정상 작동하도록 보장하는 데 필요한 무언가가 누락되었다는 것을 발견했습니다

찾아볼 수 있나요?

앞으로 24시간 안에 이 스레드에 모든 내용을 공개하겠습니다 ↓
+ 누락된 것이 무엇인지
+ 어떤 계약인지
+ 어떤 보안 업체가 발견했는지
+ 현재 수정된 코드는 어떤 모습인지

---
답이 나왔을 때 알림을 받고 싶다면 댓글을 달아주세요!

🧑‍🏫 THE BUG EXPLAINED
*as @mihaikodo already found the right answer

this is @LinearProtocol's $LiNEAR token contract from 2022, audited by @BlockSecTeam

this finding went as a recommendation, named
"Missing check on the `prepaid_gas` in function `ft_transfer_call`"

the `prepaid_gas` should be checked to ensure it is enough for the target functions including `ft_on_transfer` and `ft_resolve_transfer`

current code already has the fix implemented, which is a `require!()` macro for the `env::prepaid_gas`

basically, it requires `ft_transfer_call` calls to have some prepaid gas attached that is checked against a minimum amount to make sure the entire transaction journey (with cross-contract calls) work flawlessly

this is important because if gas isn't enough, the contract's callbacks may fail later, which worsens the user experience and creates some security risks

now, everything is checked beforehand.
if prepaid_gas is too low, the contract will panic and more gas will be requested -- the transaction never

@mihaikodo @LinearProtocol @BlockSecTeam you can read the full report here:
https://t.co/fm5P43QQVa