Tadle

Description

In the DeliveryPlace contract, there is an important inconsistency between the documented behavior and the actual implementation of authority checks in the settleAskTaker function.

• The comment states: "caller must be stock authority"

• The implementation checks for offer authority

This discrepancy suggests that the implemented authority checks may not align with the intended access control design. The presence of correct stock authority checks in other parts of the contract further indicates that these functions may be incorrectly implemented.

Impact

The potential impacts of this vulnerability include:

1. Unauthorized Access: Incorrect authority checks could allow unauthorized parties to settle ask takers, potentially manipulating the market or causing financial losses.

2. Inconsistent Behavior: The discrepancy between different function's authority checks could lead to unpredictable and inconsistent contract behavior.

Mitigation

To address this vulnerability, we recommend the following steps:

1. For settleAskTaker: Change the authority check to use stockInfo.authority:

   if (_msgSender() != stockInfo.authority) {

   revert Errors.Unauthorized();

   }