Tadle

Tadle

Tadle

DeFi
30,000 USDC
Submission Details
Severity: low
Invalid

Flow in DeliveryPlace.closeBidTaker allow users to create more point tokens than exists in the maker's offer

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

[invalid] finding-PreMarkets-closeBidTaker-userRemaining-points-wrong-set

Valid high, regardless for turbo or protected mode, partial settlements are possible as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L286-L299). For protected mode, partial settlements are not accounted for, allowing more then intended points to be sent to users even when maker only performed a partial settlement Note for invalidation: Agree with the discussions above that this issue is invalid.Β  Protected Mode is a step-by-step process. Example: > A created a purchase order for 800 points, B bought 300 points of it, and C bought 500 points of it. C re-listed 500 points, and D bought 200 points of them. > Settlement phase. A settles with B and C. C settles with D. A pays 800 point tokens, and C pays 200 point tokens to D, so the total Balance will have 1000 point tokens. Additionally, for any maker that does not settle, they will lose their original collateral posted in protected mode as it will force the admin to step in to settle.

Appeal created

cryptomoon Auditor
about 1 month ago
0xbrivan2 Auditor
about 1 month ago
cryptomoon Auditor
about 1 month ago
cryptomoon Auditor
about 1 month ago
0xbrivan2 Auditor
about 1 month ago
cryptomoon Auditor
about 1 month ago
0xbrivan2 Auditor
about 1 month ago
ge6a Submitter
30 days ago
0xnevi Lead Judge
18 days ago
0xnevi Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

[invalid] finding-PreMarkets-closeBidTaker-userRemaining-points-wrong-set

Valid high, regardless for turbo or protected mode, partial settlements are possible as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/DeliveryPlace.sol#L286-L299). For protected mode, partial settlements are not accounted for, allowing more then intended points to be sent to users even when maker only performed a partial settlement Note for invalidation: Agree with the discussions above that this issue is invalid.Β  Protected Mode is a step-by-step process. Example: > A created a purchase order for 800 points, B bought 300 points of it, and C bought 500 points of it. C re-listed 500 points, and D bought 200 points of them. > Settlement phase. A settles with B and C. C settles with D. A pays 800 point tokens, and C pays 200 point tokens to D, so the total Balance will have 1000 point tokens. Additionally, for any maker that does not settle, they will lose their original collateral posted in protected mode as it will force the admin to step in to settle.

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.