Offer maker might steal taker's collateral by settling in the last moment
Summary
Someone could create offer in protected mode and wait for last moment with settlement, to not give any time span for his takers to settle their own offers.
Vulnerability Details
Alice creates offer in protected mode
Mike takes that offer and list his own
Alice takes Mike offer (from the same or different wallet)
Alice do not settle till the very last moment, she frontrun
updateMarketPlaceStatuscalled by protocol owner
Impact
Mike does not have any time to settle his offer, which means that his collateral will be taken and transfered to Alice.
At this time the only thing Mike could do it, to try get these tokens from different source, which might be hard, and he would loss money in such trade.
Tools Used
Manual Review
Recommendations
Once Alice settles, her tokens should be transferred to the target recipients. There is no need to transfer it first to Mike and then Mike transfering it to Alice.
Lead Judging Commences
[invalid] finding-DeliveryPlace-owner-do-not-call-settleAskMaker
Invalid, the makers are incentivized to settle offers to earn maker bonuses when subsequent takers and makers make trade using the original collateral put up for points as well as get back their initial collateral. Additionally, if they do not settle on time, they will lose all their initial collateral, forcing the `owner` to come in and perform the settlement and retrieving that collateral. This is noted as a design decision [here](https://tadle.gitbook.io/tadle/how-tadle-works/features-and-terminologies/settlement-and-collateral-rate) If all else fails, the `owner` can come in to settle as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L254-L256) and [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L365-L367) offers to allow closing offers and subsequently allowing refunds. I acknowledge that perhaps a more decentralized
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.