Summary

Malicious users can delete plots from other users in a specific edge case

Vulnerability Details

Let's look at the code of _transferPlot

As we can see, the way transfer works, is that the receiver's index + start slot is overwritten to its new value. This could be problematic, if a user manages to invoke a transfer for an index which the receiver already has.

Though, since two users cannot possibly have plots on the same index, the only way this could be executed is through a 0-value transfer.

As we can see, the only restriction _fillPodOrder has is that the filled amount is at least the minFillAmount. Meaning that if minFillAmount == 0, a 0-value fill amount will succeed.

Here's how an attacker can utilize the system:

1. Attacker get some plots

2. Attacker creates a podOrder from another wallet with minFillAmount == 0.

3. Attacker fills the podOrder with 0. This will add the needed index to the new wallet's plotIndexes

4. Attacker creates a listing for their plots

5. Victim fills the listing and buys attacker's plots.

6. Now if victim has/creates a podOrder with minFillAmount == 0, the attacker can fill it with 0 and override the just bought plots, deleting them.

Impact

Loss of plots

Tools Used

Manual review

Recommendations

Never allow 0-value plot transfers