Tadle

Summary

In the DeliveryPlace contract, when settleAskTaker is called by a seller to settle pointTokens for the buyer, the function incorrectly updates the makerInfo.tokenAddress instead of the marketPlaceInfo.tokenAddress.

Vulnerability Details

• The makerInfo's tokenAddress is the address of the token that is used as collateral or the advance payment, in this case it is the advance payment token made by the buyer.

• Whereas, the marketPlaceInfo's tokenAddress is the address of the points tokens, as we can also confirm here and here.

We can see from the code that when the seller tries to settle the pointTokens to the buyer the function will pull in the marketPlaceInfo.tokenAddress as the pointToken but call addTokenBalance with makerInfo.tokenAddress.

Impact

Buyers will never recieve the point tokens that they bought, instead they will get the same token they they used to pay the points. This will break the accounting system of the protocol since a pointsToken is added to the capital pool but the balance of a different token is increased.

The buyer's loss or gain due to this mistake will depend on multiple factors such as the initial ratio of points to amount, the tokenPerPoint and the actual price of the token, etc.

This mistake is also found in the closeBidTaker function.

Tools Used

manual

Recommendations

Change this line in settleAskTaker fucntion to: