Tadle

Summary

The DeliveryPlace::settleAskTaker function sends the wrong token to the Bid maker, leading to a Denial of Service (DoS) and potential loss of funds.

Vulnerability Details

In the DeliveryPlace::settleAskTaker function, the protocol sends the wrong token to the Maker being settled. As shown in the code snippet below, the token that is attempted to be sent to the maker (offerInfo.authority) is makerInfo.tokenAddress instead of marketplaceInfo.tokenAddress.

Difference Between makerInfo.tokenAddress and marketplaceInfo.tokenAddress:

• makerInfo.tokenAddress is a variable in the MakerInfo struct, set when the offer is created. It represents the collateral type used for the offer.

• marketplaceInfo.tokenAddress is the token exchanged for points, which is set along with the other marketplaceInfo variables when SystemConfig::updateMarket is called by the owner.

Impact

This vulnerability leads to two critical issues:

1. DoS (Denial of Service):

   • The function may revert if the user does not have the necessary approval set for the collateral token.

   • Even if the allowance is set, the function can still revert due to an insufficient balance, as the caller was not expecting to send that particular token.

2. Loss of Funds:

   • Incorrect conversion of tokens can occur, leading to a loss of funds for either the caller or the receiver. For example, 10 units of USDC is not the same as 10 units of WETH.

Tools Used

Manual

Recommendations

Change makerInfo.tokenAddress to marketplaceInfo.tokenAddress.