Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The settleAskTaker function in DeliveryPlace.sol allows the stock authority to settle an Ask taker, distributing settled point tokens and collateral fees.

0x1912

Summary

The settleAskTaker function in DeliveryPlace.sol allows the stock authority to settle an Ask taker, distributing settled point tokens and collateral fees.

Vulnerability Details

The function calculates the settled point token amount based on the market place's token per point and the settled points.

And then credits pointToken to bid offer's owner(maker).

function settleAskTaker(address _stock, uint256 _settledPoints) external {
​
__SNIP__
​
uint256 settledPointTokenAmount = marketPlaceInfo.tokenPerPoint *
_settledPoints;
ITokenManager tokenManager = tadleFactory.getTokenManager();
if (settledPointTokenAmount > 0) {
tokenManager.tillIn(
_msgSender(),
marketPlaceInfo.tokenAddress,
settledPointTokenAmount,
true
);
​
tokenManager.addTokenBalance(
TokenBalanceType.PointToken,
offerInfo.authority,
@> makerInfo.tokenAddress,
settledPointTokenAmount
);
}
__SNIP__
}

As we can see in above code, offer's owner can receive collateral token but not point token.

Impact

It makes protocol useless and breaks protocol, because accounting system is not working in correctly.

Due to this, user can't get point token and collateral token can be at risk, breaking protocol running.

Tools Used

Manual review

Recommendations

please use correct point token address.

function settleAskTaker(address _stock, uint256 _settledPoints) external {
​
__SNIP__
​
uint256 settledPointTokenAmount = marketPlaceInfo.tokenPerPoint *
_settledPoints;
ITokenManager tokenManager = tadleFactory.getTokenManager();
if (settledPointTokenAmount > 0) {
tokenManager.tillIn(
_msgSender(),
marketPlaceInfo.tokenAddress,
settledPointTokenAmount,
true
);
​
tokenManager.addTokenBalance(
TokenBalanceType.PointToken,
offerInfo.authority,
- makerInfo.tokenAddress,
+ maketPlaceInfo.tokenAddress,
settledPointTokenAmount
);
}
__SNIP__
}
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-DeliveryPlace-settleAskTaker-closeBidTaker-wrong-makerinfo-token-address-addToken-balance

Valid high severity, In `settleAskTaker/closeBidTaker`, by assigning collateral token to user balance instead of point token, if collateral token is worth more than point, this can cause stealing of other users collateral tokens within the CapitalPool contract, If the opposite occurs, user loses funds based on the points they are supposed to receive

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.