_beforeTokenTransfer auditor suggestion

etherfi-protocol · Oct 8, 2024 · f979658 · f979658
1 parent 601ff25
commit f979658
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 13 deletions.
diff --git a/src/WithdrawRequestNFT.sol b/src/WithdrawRequestNFT.sol
@@ -370,9 +370,12 @@ contract WithdrawRequestNFT is ERC721Upgradeable, UUPSUpgradeable, OwnableUpgrad
 
     // invalid NFTs is non-transferable except for the case they are being burnt by the owner via `seizeInvalidRequest`
     function _beforeTokenTransfer(address /*from*/, address /*to*/, uint256 firstTokenId, uint256 batchSize) internal view override {
-        for (uint256 i = 0; i < batchSize; i++) {
-            uint256 tokenId = firstTokenId + i;
-            require(_requests[tokenId].isValid || msg.sender == owner(), "INVALID_REQUEST");
+        if (msg.sender != owner()) {
+            // if not called by the contract owner, only allow transfers of valid NFTs
+            for (uint256 i = 0; i < batchSize; i++) {
+                uint256 tokenId = firstTokenId + i;
+                require(_requests[tokenId].isValid, "INVALID_REQUEST");
+            }
         }
     }
 

diff --git a/test/WithdrawRequestNFT.t.sol b/test/WithdrawRequestNFT.t.sol
@@ -311,24 +311,15 @@ contract WithdrawRequestNFTTest is TestSetup {
         assertEq(eETHInstance.balanceOf(address(withdrawRequestNFTInstance)), 8);
         // Within `LP.requestWithdraw`
         // - `share` is calculated by `sharesForAmount` as (9 * 98) / 100 = 8.82 ---> (rounded down to) 8
-
-        uint256 dustSharesBefore = withdrawRequestNFTInstance.getAccumulatedDustEEthAmount();
-        console.log("dustSharesBefore: ", dustSharesBefore);
-
+
         vm.prank(address(membershipManagerInstance));
         liquidityPoolInstance.rebase(2);
 
         _finalizeWithdrawalRequest(requestId);
 
-        uint256 dustSharesAfter = withdrawRequestNFTInstance.getAccumulatedDustEEthAmount();
-        console.log("dustSharesAfter: ", dustSharesAfter);
-
         vm.prank(bob);
         withdrawRequestNFTInstance.claimWithdraw(requestId, 1);
 
-        uint256 dustSharesAfter2 = withdrawRequestNFTInstance.getAccumulatedDustEEthAmount();
-        console.log("dustSharesAfter2: ", dustSharesAfter2);
-
         // Within `claimWithdraw`,
         // - `request.amountOfEEth` is 9
         // - `amountForShares` is (8 * 100) / 98 = 8.16 ---> (rounded down to) 8