Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

In the `DeliveryPlace.closeBidTaker` function, if the offer is settled partially, collateral for unsettled points should be liquidated by bid taker.

kupiasec

Github link

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L178-L200

Summary

In the DeliveryPlace.closeBidTaker function, all of collaterals for settled offer are liquidated by the bid taker.
If offer is settled partially, collaterals only for unsettled points should be liquidated.
As a result, bid taker can receive unexpected collaterals and this causes the protocol's loss of funds.

Vulnerability Details

In the DeliveryPlace.closeBidTaker function, if preOffer is settled, the portion of settledPointTokenAmount point tokens are added to bid taker from L195

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L190-L200

uint256 pointTokenAmount = offerInfo.settledPointTokenAmount.mulDiv(
userRemainingPoints,
offerInfo.usedPoints,
Math.Rounding.Floor
);
L195: tokenManager.addTokenBalance(
TokenBalanceType.PointToken,
_msgSender(),
makerInfo.tokenAddress,
pointTokenAmount
);

Thus, the collateral only for unsettled points should be liquidated.
But, collaterals for settled points are also liquidated from L184.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L178-L189

uint256 userCollateralFee = collateralFee.mulDiv(
userRemainingPoints,
offerInfo.usedPoints,
Math.Rounding.Floor
);
L184: tokenManager.addTokenBalance(
TokenBalanceType.RemainingCash,
_msgSender(),
makerInfo.tokenAddress,
userCollateralFee
);

Impact

The bid taker can receive unexpected collaterals and this causes the protocol's loss of funds.

Tools Used

Manual Review

Recommendations

In the DeliveryPlace.closeBidTaker function, if the preOffer is settled, liquidate the collaterals for unsettled points.

Updates

Lead Judging Commences

0xnevi Lead Judge
10 months ago
0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Too generic

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.