Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

BUSINESS LOGIC - The current protocol implementation gives sellers excessive profits from taxes and sales in turbo mode, reducing the incentive to provide points

amaron

Summary

The turbo mode definition:
"In Turbo Mode, the original seller deposits crypto as collateral, enabling subsequent traders to buy and sell points without additional collateral. Upon settlement, the original seller transfers tokens to all remaining buyers. Additionally, the original seller earns a maker bonus on every subsequent trade made from their original offer."
*taken from Tadle's docs.
however, this can lead users to never provide the points, and malicious users to create fake sell orders, as they can claim bigger amount then they have originally deposited.

Vulnerability Details

This implementation of the protocol, let sellers claim 100% of SalesRevenue and TaxIncome and might incentivize them to never provide the points
as sellers can receive the collateral they have provided + tax, they are already in profit, and it might create a different situation where they might profit more if they will not provide the tokens and claim their collateral, for example by selling in the market for more, or might incentivize people to create fake sell orders, without any points they really have, just to claim the taxes + sales profit.

PoC this proves that sellers will be in profit even BEFORE providing the points:

function test_farm_tax() public {
vm.startPrank(user);
uint256 balanceBefore = mockUSDCToken.balanceOf(user);
​
preMarktes.createOffer(
CreateOfferParams(
marketPlace, address(mockUSDCToken), 1_000, 1 ether, 10000, 300, OfferType.Ask, OfferSettleType.Turbo
)
);
vm.stopPrank();
vm.startPrank(user1);
​
console2.log("Balance before", balanceBefore);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
address stockAddr = GenerateAddress.generateStockAddress(0);
address offerAddr = GenerateAddress.generateOfferAddress(0);
preMarktes.createTaker(offerAddr, 1000);
vm.stopPrank();
vm.startPrank(user);
tokenManager.withdraw(address(mockUSDCToken), TokenBalanceType.SalesRevenue);
tokenManager.withdraw(address(mockUSDCToken), TokenBalanceType.TaxIncome);
console2.log("Balance after ", mockUSDCToken.balanceOf(user));
uint256 balanceAfter = mockUSDCToken.balanceOf(user);
assert(balanceAfter > balanceBefore);
​
vm.stopPrank();
}

LOGS:

[PASS] test_farm_tax() (gas: 934837)
Logs:
Balance before 2000000000000000000
Balance after 2030000000000000000
​
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.44ms (1.36ms CPU time)

Impact

the current implementation of turbo mode might lead users to severe loss of funds, and challenges the credibility of the entire protocol

Tools Used

foundry

Recommendations

consider changing turbo mode to allow only partial SalesRevenue claiming, to make sure sellers never get in profit BEFORE providing the tokens.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-immediate-withdrawal-allow-maker-steal-funds

Valid high severity, given orginal offer makers are not a trusted entity to enforce a settlement. The trade tax set by the maker should be returned back to the takers to avoid abuse of abortion of ask offers to steal trade tax from takers. Note for appeals period: See issue #528 for additional details

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!