Malicious homeowners can rug

[c4-bot-10]

Lines of code

https://github.com/code-423n4/2024-10-coded-estate/blob/main/contracts/codedestate/src/execute.rs#L523-L541

Vulnerability details

Description

Homeowners can trigger burn() (CW_721) from execute.rs file.
They can pass the token_id and burn it without checking if the homeowner has ongoing rent or any reservations.

    fn burn(
        &self,
        deps: DepsMut,
        env: Env,
        info: MessageInfo,
        token_id: String,
    ) -> Result<Response<C>, ContractError> {
        let token = self.tokens.load(deps.storage, &token_id)?;
        self.check_can_send(deps.as_ref(), &env, &info, &token)?;

        self.tokens.remove(deps.storage, &token_id)?;
        self.decrement_tokens(deps.storage)?;

So, a malicious homeowner can rug his customers which will lead the travelers with approved/non-approved rent will lose their deposit.
By triggering execute.rs#burn() at any time.

Impact

• Malicious homeowners can rug
• Travelers with approved/non-approved rent will lose their funds
• the current tenant can't finish his paid period

Tools Used

Manual Review

Recommended Mitigation Steps

call check_can_edit_long() or check_can_edit_short() (currently are the same thing) to check if the rentals is empty or no active rent/reservation

File: execute.rs#burn()

fn burn(
        &self,
        deps: DepsMut,
        env: Env,
        info: MessageInfo,
        token_id: String,
    ) -> Result<Response<C>, ContractError> {
        let token = self.tokens.load(deps.storage, &token_id)?;
        self.check_can_send(deps.as_ref(), &env, &info, &token)?;
+       self.check_can_edit_short(&env, &token)?;

Assessed type

Rug-Pull

[c4-judge]

OpenCoreCH marked the issue as duplicate of #2

[c4-judge]

OpenCoreCH marked the issue as satisfactory