Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

``settleAskMaker()`` and ``settleAskTaker()`` doesn't work with ``wrappedNativeToken``.

0xsandy

Summary

settleAskMaker() and settleAskTaker() doesn't work with wrappedNativeToken.

Vulnerability Details

settleAskMaker is implemented as:

function settleAskMaker(address _offer, uint256 _settledPoints) external {
​
--SNIP--
​
uint256 settledPointTokenAmount = marketPlaceInfo.tokenPerPoint * _settledPoints;
​
ITokenManager tokenManager = tadleFactory.getTokenManager();
if (settledPointTokenAmount > 0) {
tokenManager.tillIn(_msgSender(), marketPlaceInfo.tokenAddress, settledPointTokenAmount, true);
}
​
--SNIP--
}

In the tillIn() function, if tokenAddress == wrappedTokenAddress,

function tillIn(address _accountAddress, address _tokenAddress, uint256 _amount, bool _isPointToken)
external
payable
onlyRelatedContracts(tadleFactory, _msgSender())
onlyInTokenWhiteList(_isPointToken, _tokenAddress)
{
/// @notice return if amount is 0
if (_amount == 0) {
return;
}
​
address capitalPoolAddr = tadleFactory.relatedContracts(RelatedContractLibraries.CAPITAL_POOL);
if (capitalPoolAddr == address(0x0)) {
revert Errors.ContractIsNotDeployed();
}
​
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @notice check msg value
* @dev if msg value is less than _amount, revert
* @dev wrap native token and transfer to capital pool
*/
if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
// @issue extra msg.value is stuck forever
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);
// @audit some tokens doens't return bool on success
}
---SNIP

msg.value is used and it is wrapped. But settleAskMaker() is not a payable function and msg.value can't be sent to tokenManager.tillIn() function.

Impact

Contract Functionality DOS.

Tools Used

Manual Analysis

Recommendations

Make settleAskMaker() and settleAskTaker() functions payable and send msg.value as tokneManager.tillIn{value: msg.value}(),

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-PreMarkets-settleAskMaker-settleAskTaker-no-msg.value-sent

Invalid, in `settleAskMaker` and `settleAskTaker` you are settling the point token to be given to the takers, which is an ERC20 token, so no native ETH is involved and thus no msg.value is required.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.