Tadle

Summary

In DeliveryPlace.sol, due to the lack of check if the marketPlaceInfo.tokenPerPoint has been set or not, attackers can gain funds.

Vulnerability Details

The marketplace is updated using 2 different functions,

1. updateMarketPlaceStatus (status is being updated)

2. updateMarket (rest of the parameters are being updated)

Assume the following scenario,

1. Owner updates the marketplace status to AskSettling,

2. The attacker (an ask maker), calls the settleAskMaker() function with _settledPoints = usedPoints.

3. Since the tokenPerPoint has not been set by the admin, settledPointTokenAmount = 0

   https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L262-L263

   uint256 settledPointTokenAmount = marketPlaceInfo.tokenPerPoint *

   _settledPoints;

4. The attacker will have to pay 0 point tokens, and will receive the entire collateral, and the funds given by the taker. Thus making a profit.

Impact

Attacker can unfairly earn a profit without paying the points token.

Tools Used

Manual Review

Recommendations

Add a check to make sure that marketPlaceInfo.tokenPerPoint is set.