Tadle

Summary

In the case of a partial settlement in the DeliveryPlace.settleAskTaker() function, the Taker of the Bid offer will transfer Points tokens to settle the Bid offer. Unfortunately, this transfer will not reduce the collateral based on the settled amount. As a result, the Taker will lose both the deposited collateral and the Points tokens transferred for settlement, because the stock will be updated to the status Finished, preventing a full settlement.

Vulnerability Details

In the DeliveryPlace.settleAskTaker() function, there is a check:

This check indicates that _settledPoints can range from 0% to 100% of stockInfo.points. However, if the Taker of the Bid offer opts for a partial settlement (0 < _settledPoints < stockInfo.points), all transferred Points tokens will be lost. Additionally, the Taker will not be able to settle the stock in full, leading to the loss of their entire collateral and the Points tokens, which will be distributed to the Maker of the Bid offer as compensation.

This issue arises because after calling the DeliveryPlace.settleAskTaker() function, the stock status will be set to Finished, and all settled Points tokens will be allocated to the Maker. Consequently, the Taker's collateral will not be proportionally reduced.

Impact

The Taker of the Bid offer will lose funds in the form of Points tokens and collateral tokens proportional to the settled Points tokens.

Tools Used

Manual review.

Recommendations

• Prevent partial settlements by requiring either 0 _settledPoints or the full amount of stockInfo.points.

  OR

• If partial settlements are permitted, adjust the collateral used for compensation and refund a portion to the Taker proportional to the transferred _settledPoints amount.