Tadle

Summary

wrong token address assignment leads to withdrawing the wrong token

Vulnerability Details

The DeliveryPlace::settleAskTaker function assigns the wrong token address for the bid-maker who wants to receive a point token, not an erc20 token (e.g. usdc). in the settleAskTaker function:

after the bid maker calls the settleAskTaker function, it should assign the desired point token for the bid maker. but the function assigns the makerInfo.tokenAddress for the bid maker which is wrong. this is the token the bid maker paid to get the point token but now he is gonna withdraw the wrong token

after the bid maker calls the settleAskTaker function, now he thinks his point token is ready to withdraw so he calls the TokenManager::withdraw function with the point token as the first parameter but it will revert cause the protocol assigns the wrong token address.
the bid maker must call the withdraw with the erc20 token as the first param but in the end, he receives the erc20 token not the point token.

Impact

the main functionality of the protocol is disruption and users can't withdraw their desired point token

Tools Used

manual review

Recommendations

in the DeliveryPlace::settleAskTaker:

Although you must handle the settledPointTokenAmount properly to not point to the wrong number