Tadle

Summary

The createOffer and listOffer functions allow a collateralRate of exactly 100%, contrary to the protocol’s expectation of requiring it to be strictly greater than 100%. This discrepancy fails to provide the necessary safety buffer for volatile assets like cryptocurrencies, potentially exposing users and the protocol to financial risks and not enough collateral coverage.

Vulnerability Details

The collateralRate parameter is designed to ensure that sufficient collateral is deposited to back an offer. According to the comment in the code:

The intention is that the collateralRate should be greater than 100%, providing a buffer to cover the volatility of crypto assets. However, the current implementation allows the collateralRate to be exactly 100%, which does not align with the intended security measures.

Code Snippets

createOffer function

listOffer function

In both functions, the check for collateralRate only ensures that it is not less than 100% but does not prevent it from being exactly 100%. This fails to provide the necessary buffer for assets that are volatile.

Impact

1. Financial Risk to Users: A collateralRate of exactly 100% might result in not enough collateral to cover potential losses, especially with volatile assets. This lack of buffer can lead to financial losses for users in case of defaults.

2. Protocol Security: The protocol aims to have a buffer to handle volatility, but a collateralRate of 100% fails to provide this, undermining the intended security.

3. Potential for Exploitation: Insufficient collateral can be exploited by malicious actors, potentially compromising the protocol’s integrity and causing financial harm to other users.

Tools Used

VSCode

Recommendations

Adjust the check in the createOffer and listOffer functions to ensure that the collateralRate is strictly greater than 100%. This adjustment will ensure that users are required to deposit more collateral than the value of the offer, providing a necessary buffer.

Additionaly consider adjusting collateral rate for Crypto Assets. For stablecoins, a collateral rate slightly above 100% might suffice. However, for volatile crypto assets, it is advisable to set a higher collateral rate, such as 150%, to account for price fluctuations and ensure adequate coverage.