Tadle

Summary

If an ask maker (who is not the origin) in turbo mode, calls the settleAskMaker function. He is refunded amount x collateral. But as it is turbo mode he had never deposited this amount.

Vulnerability Details

Assume the following scenario:

1. Bob creates an ask offer in turbo mode of 100 points for amount = 100USDC with collateral = 20,000

2. Therefore Bob deposits 200USDC.

3. Alice calls the createTakerfunction, and deposits 100USDC + tax + platformFee

4. Alice creates an offer with amount = 200USDC, collateral remains the same as it is turbo mode

5. Note that Alice doesnt have to deposit any collateral as it is turbo mode.
   https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L335-L343

   if (makerInfo.offerSettleType == OfferSettleType.Turbo) {

   address originOffer = makerInfo.originOffer;

   OfferInfo memory originOfferInfo = offerInfoMap[originOffer];

   ​

   if (_collateralRate != originOfferInfo.collateralRate) {

   revert InvalidCollateralRate();

   }

   originOfferInfo.abortOfferStatus = AbortOfferStatus.SubOfferListed;

   }

1. Now the marketplace goes into the asksettling phase, and alice calls the settleAskMaker function and pays 0, since the used_points = 0.

2. Here since there is no check for turbo mode, Alice is refunded 200 x 200%( amount x collateral) = 400USDC

   https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L275-L307

Clearly Alice should have been refunded 0, but she is being given 400USDC.

Note: Alice can use much larger amounts to increase her earnings.

Impact

The attacker (Alice) can drain the entire funds of the contract by setting a very large amount.

Tools Used

Manual Review

Recommendations

Add a check in the settleAskMaker function for turbo mode as follows (line 274 DeliveryPlace.sol):