Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

In `Turbo` mode, malicious makers can steal collateral by settling listed ask offers.

kupiasec

Github link

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L301

Summary

In the DeliveryPlace.settleAskMaker function, it does not check the offer is makerInfo.originOffer and it refunds the collateral for settled points.
Thus, in Turbo mode, settling listed ask offer which is not makerInfo.originOffer also refunds collateral.
In Turbo mode, listing ask offer does not require collateral.
As a result, not provided collateral are refunded and this causes the protocol's loss of funds.

Vulnerability Details

In the DeliveryPlace.settleAskMaker function, collateral for settled points are refunded from L301.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L301

L301: tokenManager.addTokenBalance(
TokenBalanceType.SalesRevenue,
_msgSender(),
makerInfo.tokenAddress,
makerRefundAmount
);

In Turbo mode, collaterals are provided only for makerInfo.originOffer, not for listed offer whith is not makerInfo.originOffer.
Let's assume that makerInfo.offerSettleType is Turbo and user tries to settle the listed ask offer.
If offer.authority tries to settle the offer, the DeliveryPlace.settleAskMaker function refunds the collateral which is not provided by authority.

Impact

This causes the protocol's loss of funds.

Tools Used

Manual Review

Recommendations

It is recommended to change the code as following:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L228

(
OfferInfo memory offerInfo,
MakerInfo memory makerInfo,
MarketPlaceInfo memory marketPlaceInfo,
MarketPlaceStatus status
) = getOfferInfo(_offer);
+ require(makerInfo.originOffer == _offer, "Invalid settling listed offers")
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-Premarkets-listOffer-turbo-settleAskMaker-exploit-settlement

Valid high severity, this allows resellers listing offers via `listOffer/relistOffer` to game the system. Based on the inherent design of Turbo mode not requiring takers making ask offers for the original maker offer to deposit collateral, the wrong refund of collateral to takers even when they did not deposit collateral due to turbo mode during settleAskMaker allows possible draining of pools.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.