Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Failure in `tillIn` Function for WETH Marketplace Operations

0xpep7

Summary

A critical vulnerability exists in the DeliveryPlace contract where the tillIn function fails in cases where the marketplace operates on WETH. This failure causes the settleAskTaker and settleAskMaker functions to become inoperable, potentially disrupting the protocol's operations.

Vulnerability Details

  • Found in src/core/DeliveryPlace.sol at Line 267 and src/core/DeliveryPlace.sol at Line 377

@>: if marketPlaceInfo.tokenAddress == wrappedNativeToken or the marketplace operates on WETH, it would require extra ETH sent in via tillIn{value: msg.value}(...)

222: function settleAskMaker(address _offer, uint256 _settledPoints) external {
...
266: if (settledPointTokenAmount > 0) {
267:@> tokenManager.tillIn(
268: _msgSender(),
...
325: }
...
335: function settleAskTaker(address _stock, uint256 _settledPoints) external {
...
376: if (settledPointTokenAmount > 0) {
377:@> tokenManager.tillIn(
378: _msgSender(),
...
433: }

Impact

This vulnerability has a Medium impact, as the failure of the tillIn function prevents the settleAskTaker and settleAskMaker functions from operating correctly. This could result in a denial of service (DOS) for users participating in WETH-based marketplaces.

Tools Used

Manual Review

Recommendations

Make the corresponding functions payable to receive msg.value and forward ETH to tokenManager.tillIn{value: msg.value} to ensure that the tillIn function operates correctly in WETH marketplaces.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-PreMarkets-settleAskMaker-settleAskTaker-no-msg.value-sent

Invalid, in `settleAskMaker` and `settleAskTaker` you are settling the point token to be given to the takers, which is an ERC20 token, so no native ETH is involved and thus no msg.value is required.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.