0

I am some kinda embarrassed by "mkBuyValidator" in Martify Marketplace on-chain code . For buyer there is only one check for token transfer (on line 68): (valueOf (valuePaidTo info sig) (nCurrency nfts) (nToken nfts) == 1). And what about Ada amount or other funds that could be stolen from buyer in theory due to the fact of spending buyer's output (cause buyer is the signer)?

Am i right, that there should be some more checks?

2
  • Isn't that the responsibility of the buyer to verify before signing the transaction? Sep 20, 2022 at 21:37
  • I suppose yes. However, don't sure about that stuff. As Ethereum developer, i d like to add some more checks. That's why asked the community :) Sep 21, 2022 at 5:38

1 Answer 1

0

This is Leni from Martify Labs. Thanks for using our contract!

So here the buyer initiates the transaction and therefore sees in his wallet popup exactly what is leaving his wallet before he signs and submits. The contract’s job is to verify that the seller got paid, that the project owners received their royalties and that the marketplace operators receive their fees. We also check that the buyer gets his NFT. If a malicious marketplace builds a transaction that takes additional funds from the buyer, the buyer would see it clearly and would not sign the tx.

We know that this falls to the responsibility of the buyer, but it’s the same when you buy an item on an online shop with your credit card. You check that the price asked to be paid corresponds to the item you are buying.

Also, we wrote this contract for it to be very simple so that it can be used as a learning tool and also offer good flexibility. Let’s say you want to modify it a bit to allow bulk purchases or sales, or to allow a “buy and create new sale immediately” feature. There you would need to remove the checks you are talking about because you don’t know what user might want to include in their transaction.

Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.