Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Authorization Logic in settleAskTaker Function

cryptomoon

Summary

The settleAskTaker function contains a critical flaw in its authorization logic, which incorrectly allows the maker (who created the BID offer) to settle points intended for the taker. The current implementation allows the maker to call this function, potentially taking the full collateral of the taker.

Vulnerability Details

The settleAskTaker function incorrectly authorizes the maker (who created the BID offer) to call the settleAskTaker function, even though the function is intended to be called by the taker. The maker can exploit this by calling settleAskTaker with 0 points and claiming the full collateral of the taker, which is not the intended behavior.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/DeliveryPlace.sol#L335-L433

function settleAskTaker(address _stock, uint256 _settledPoints) external {
...
if (status == MarketPlaceStatus.AskSettling) {
if (_msgSender() != offerInfo.authority) {
revert Errors.Unauthorized();
}
} else {
....
}
......
......
if (_settledPoints == stockInfo.points) {
tokenManager.addTokenBalance(
TokenBalanceType.RemainingCash,
_msgSender(),
makerInfo.tokenAddress,
collateralFee
);
} else {
// if _settledPoints is 0
tokenManager.addTokenBalance(
TokenBalanceType.MakerRefund,
offerInfo.authority, // this will be the address of Maker who created BID offer
makerInfo.tokenAddress,
collateralFee
);
}
​

Impact

The maker can unfairly call settleAskTaker and claim the taker's collateral, leading to significant financial loss for the taker.

Tools Used

Manual review

Recommendations

The function should be updated to ensure that only the taker can call the settleAskTaker function. The authorization check should verify that the caller is the taker who is entitled to settle the points, not the maker.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-settleAskTaker-wrong-stock-authority

Valid high severity, when taker offers are created pointing to a `offer`, the relevant `stockInfoMap` offers are created with the owner of the offer aka `authority`, set as the creater of the offer, as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L245). Because of the wrong check within settleAskTaker, it will permanently DoS the final settlement functionality for taker offers for the maker that listed the original offer, essentially bricking the whole functionality of the market i.e. maker will always get refunded the original collateral, and takers will never be able to transact the original points put up by the maker. This occurs regardless of market mode.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.