Tadle

Summary

In the case of a partial settlement in the DeliveryPlace.settleAskMaker() function, the Maker will transfer Points tokens to settle their Ask offer.

Unfortunately, this will have no effect on reducing their collateral based on the settled amount.

As a result, the Maker will lose all deposited collateral and the Points tokens transferred as settlement, as the offer will be updated to the status Settled, preventing them from settling in full.

Vulnerability Details

In the DeliveryPlace.settleAskMaker() function, there is a check:

This indicates that _settledPoints can range from 0% to 100% of offerInfo.usedPoints. However, if the Maker of the Ask offer decides to settle only partially (0 < _settledPoints < offerInfo.usedPoints), all transferred Points tokens will be lost. Additionally, they will not be able to settle the offer in full, which will lead to the distribution of all their collateral for the offerInfo.usedPoints to Takers as compensation.

This is due to the fact that after calling the DeliveryPlace.settleAskMaker() function, the offer status will be set to Settled, and in the DeliveryPlace.closeBidTaker() function, the settled Points tokens will be distributed proportionally to Takers, but the Maker’s collateral will not be reduced in the same proportional way.

Impact

Loss of Maker’s funds in the form of Points tokens and collateral tokens proportional to the settled Points tokens.

Tools Used

Manual review.

Recommendations

• Do not allow partial settlements by requiring either 0 _settledPoints or the full amount of offerInfo.usedPoints.

  OR

• If partial settlements are allowed, reduce the collateral used for compensation and refund a portion of it to the Maker proportional to the transferred _settledPoints amount.