Summary

• The settleAskMaker allows the offer authority to settle points and allows the authority to deposit the points in multiple passes, so they can deposit the whole amount at once or in multiple turns.

• When full settle amount is sent, it updates the offer status to settled, but if it is settled in multiple passes and even the point tokens amount reaches to the target usedPoints, then also it doesn't give back the collateral to the offer authority due to incorrect check implemented, which only allows collateral refund only if amount is transferred in one go, but as it accepts amount to be transferred in multiple passes then it should refund the collateral token at a pass at which full point token is distributed.

Vulnerability Details

The vulnerability is present in the settleAskMaker function where it doesn't refund the collateral to the offer's authority when point token distributed in multiple passes and only allows collateral refund only if whole amount is transferred in one go when following condition is satisfied.

• As a result of which the offer's authority will never be able to claim a refund of collateral if they try to send it in multiple passes.
  Here, the offerInfo.usedPoints should be compared with the previous deposit points set via the offerInfo.settledPoints.

• Also, another vulnerability exist when updating the settledPoints and other related parameters via settledAskOffer, as it doesn't increment the parameters but just updates them leading to incorrect accounting. The parameters will reflect incorrect value and lead to disturbed accounting due to just setting them to value sent instead incrementing them.

• Also, in settledAskOffer, there is no updation related to settledCollateralAmount which should be updated when collateral is sent.

Impact

• Incorrect parameter updation instead of incrementing in settledAskOffer leads to incorrect accounting.

• Incorrect check in settleAskMaker to only allow collateral refund only if the whole points are distributed by offer's authority, which leads to not getting the collateral refund when they try to send the point token in multiple passes.

Tools Used

Manual Review

Recommendations

Step 1: Update the parameters in settledAskOffer to be incremented by the values, as below
function settledAskOffer(
address _offer,
uint256 _settledPoints,
uint256 _settledPointTokenAmount
) external onlyDeliveryPlace(tadleFactory, _msgSender()) {
OfferInfo storage offerInfo = offerInfoMap[_offer];
offerInfo.settledPoints += _settledPoints;
offerInfo.settledPointTokenAmount += _settledPointTokenAmount;

Step 2: In settleAskMaker update the below check as: