Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CS Note 8.10: Sending NFTs Does Not Reset Delegation #504

Open
bingen opened this issue Oct 9, 2024 · 1 comment
Open

CS Note 8.10: Sending NFTs Does Not Reset Delegation #504

bingen opened this issue Oct 9, 2024 · 1 comment
Assignees
Labels
ChainSecurity wontfix This will not be worked on

Comments

@bingen
Copy link
Collaborator

bingen commented Oct 9, 2024

Troves in Liquity V2 are transferable NFTs. This allows the user to transfer a trove, which means it could be sold on a marketplace. Users purchasing a trove should be aware that the delegation of the trove is not reset when the trove is transferred. This means the seller could set themselves as the remove manager and receiver before the transfer is executed (potentially setting it at the last second, frontrunning the purchase), then remove collateral from the trove after the transfer is completed.

As a result, purchasers of troves should be cautious and ensure that the purchase transaction includes a reset of the delegation.

Also note that delegation can be set in the zappers, so users must check this before delegating their trove to a zapper.

@bingen bingen self-assigned this Oct 20, 2024
@bingen bingen added the wontfix This will not be worked on label Oct 20, 2024
@bingen
Copy link
Collaborator Author

bingen commented Oct 20, 2024

Trove NFTs are not meant to be traded. The transfer ability is meant to allow management (like cold/hot wallet setups) or integrations (open a trove from a contract and transfer to owner).
Some other things can be frontrun in a trade, like adjustTrove to a worse value.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ChainSecurity wontfix This will not be worked on
Projects
None yet
Development

No branches or pull requests

1 participant