Cardano Stack Exchange is a question and answer site for users and developers of the Cardano cryptocurrency ecosystem. It only takes a minute to sign up.
Sign up to join this community
I am some kinda embarrassed by "mkBuyValidator" in Martify Marketplace on-chain code . For buyer there is only one check for token transfer (on line 68):
(valueOf (valuePaidTo info sig) (nCurrency nfts) (nToken nfts) == 1).
And what about Ada amount or other funds that could be stolen from buyer in theory due to the fact of spending buyer's output (cause buyer is the signer)?
Am i right, that there should be some more checks?
This is Leni from Martify Labs. Thanks for using our contract!
So here the buyer initiates the transaction and therefore sees in his wallet popup exactly what is leaving his wallet before he signs and submits. The contract’s job is to verify that the seller got paid, that the project owners received their royalties and that the marketplace operators receive their fees. We also check that the buyer gets his NFT. If a malicious marketplace builds a transaction that takes additional funds from the buyer, the buyer would see it clearly and would not sign the tx.
We know that this falls to the responsibility of the buyer, but it’s the same when you buy an item on an online shop with your credit card. You check that the price asked to be paid corresponds to the item you are buying.
Also, we wrote this contract for it to be very simple so that it can be used as a learning tool and also offer good flexibility. Let’s say you want to modify it a bit to allow bulk purchases or sales, or to allow a “buy and create new sale immediately” feature. There you would need to remove the checks you are talking about because you don’t know what user might want to include in their transaction.
Hope this helps!
