Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Loss of Funds in `DeliveryPlace.sol::settleAskMaker` when the param `_settledPoints` is not equal to the Offer's used Points

0xlookman

Summary

In DeliveryPlace.sol::settleAskMaker, the msgSender deposits the settledPointTokenAmount but this amount is not credited to any user's account if the functions parameter _settledPoint is not equal to the offer's used points.

Vulnerability Details

A msgSender is required to deposit the settledPointTokenAmount calculated based on the parameters _settledPoints by calling tokenManager::tillIn. After the deposit, this amount is not credited to any user's account or offer except for the makerRefundAmount which is only calculated if the _settledPoint parameter is equal to offerInfo.usedPoints.

uint256 settledPointTokenAmount = marketPlaceInfo.tokenPerPoint *
_settledPoints;
​
ITokenManager tokenManager = tadleFactory.getTokenManager();
if (settledPointTokenAmount > 0) {
tokenManager.tillIn(
_msgSender(),
marketPlaceInfo.tokenAddress,
settledPointTokenAmount,
true
);
}
​
uint256 makerRefundAmount;
if (_settledPoints == offerInfo.usedPoints) {
....code....

This rises an issue since its not required at the beginning of the function for the _settledPoints to be equal to the offerInfo.usedPoints, the only required thing is that they should not be greater.

if (_settledPoints > offerInfo.usedPoints) {
revert InvalidPoints();
}

In cases where they will be less, the amount added to the CapitalPool at Line 267 won't be recorded hence a loss of funds by MsgSender.

Impact

The message sender will loss funds to the CapitalPool and this amount is not recorded any where for him to be able to withdraw it or anyone authorised.

Tools Used

Manual Review

Recommendations

Ensure that the _settledPoints are equal to offerInfo.usedPoints, before calling tokenManager::tillIn function to ensure no funds will be lost if the points are less than the usedPoints.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.