Aavegotchi Lock

Without some kind of locking mechanism it is possible to put up an Aavegotchi for sale and for the owner to remove or alter the state of the Aavegotchi right when/after it is sold but before the transfer occurs. This is a front-running attack.
The following function locks certain assets and the state of an Aavegotchi for a number of seconds specified by _lockDuration
1
function lockAavegotchi(uint256 _tokenId, uint256 _lockDuration) external 
2
  onlyUnlocked(_tokenId) 
3
{
4
  require(
5
    s.aavegotchis[_tokenId].status == LibAppStorage.STATUS_AAVEGOTCHI, 
6
    "AavegotchiFacet: Must be claimed"
7
  );
8
  require(
9
    msg.sender == s.aavegotchis[_tokenId].owner, 
10
    "AavegotchiFacet: Only owner can lock aavegotchi"
11
  );
12
  s.aavegotchis[_tokenId].unlockTime = block.timestamp + _lockDuration;
13
  emit LockAavegotchi(_tokenId, _lockDuration);
14
 }
Copied!
The onlyUnlocked modifier is on functions that should only be called when an aavegotchi is unlocked. It causes functions to revert if an aavegotchi is locked.
1
modifier onlyUnlocked(uint256 _tokenId) {
2
  require(
3
    s.aavegotchis[_tokenId].unlockTime < block.timestamp, 
4
    "Only callable on unlocked Aavegotchis"
5
  );
6
  _;
7
}
Copied!
The general rule is that state changes caused by external function calls that can be bad for an aavegotchi can only succeed when the aavegotchi is unlocked.
Here are functions that can only be called when an Aavegotchi is unlocked:
setAavegotchiName
spendSkillPoints
lockAavegotchi
decreaseStake
decreaseAndDestroy
transferFromParent ERC998 function that transfers items out of aavegotchi.
transferAsChild ERC998 function that transfers items out of aavegotchi to other aavegotchi or NFT.
useConsumable
Note that the equipWearables function does not have to be unlocked to use. The reason is because equipWearables does not remove items from the inventory of an Aavegotchi.

Overview - Previous

Governance

Next - Overview

Deployment

Last modified 11mo ago

Copy link