Summary

• The settleAskTaker is performs the task to transfer the PointToken from the taker (stock's authority) to the capital pool and allocate them to the offer's direct maker (authority) via the addTokenBalance for them for that PointToken.

• But while calling the addTokenBalance it passes incorrect parameter for token address, instead of passing the point token address, it passes the collateral token address as a result of which the offer's authority will not be able to withdraw their point token, instead they are given the access to withdraw the collateral token with amount being settledPointTokenAmount and the point token sent to capital pool remains unallocated.

Vulnerability Details

• The vulnerability is present in the settleAskTaker where it passes incorrect address for point token for allocating it to the offer's authority after transferring it to the capital pool from the taker.

• Here, makerInfo.tokenAddress represents the collateral token address where it is used as collateral and performing exchange for point token, and marketPlaceInfo.tokenAddress represents the point token address.

• Thus, incorrect address is allocated for the point token address, which results in offer's authority to not able to withdraw their point token, instead gets access to collateral token.

Impact

• The addTokenBalance function is expected to allocate the settledPointTokenAmount to offer authority for point token address on the TokenManager but instead it does it in collateral token, which makes the offer authority to not able to withdraw point token and it remains unallocated in CapitalPool.

• And the accounting for makerInfo.tokenAddress gets disturbed as the offer's authority would be able to withdraw it causing incorrect accounting in CapitalPool, leading to someone not be able to withdraw it due to excess withdrawal caused by incorrect allocation in settleAskTaker function.

Tools Used

Manual Review

Recommendations

Instead of using makerInfo.tokenAddress, update it to marketPlaceInfo.tokenAddress while calling addTokenBalance to allocate point tokens to offer's authority.