Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Permanent DOS for sellers due to wrong access control check in the settleAskTaker function which will cause points to never settle.

touthang

Summary

settleAskTaker function gives permission to the buyer instead of the seller which makes it impossible for the seller to call the function and settle points for the buyer.

Vulnerability Details

The purpose of the settleAskTaker function is to be used by the seller to fulfill settelments.
Seller in this case is a fullfiller of a buy offer, as we can see from the code:

if (stockInfo.stockType == StockType.Bid) { // stockType must be ask(selling) which means the offer is a buy offer
revert InvalidStockType();
}

Example-

  • Bob creates a buy/bid offer

  • Alice fulfills Bob's buy offer, an ask stock is created for Alice

So, Alice is the taker who sells and Bob is the maker who buys in this example.

Therefore, stockInfo.authority is Alice(seller)
and offerInfo.authority is Bob(buyer).

If Alice(seller) now tries to call settleAskTaker to settle points for Bob it will revert because of the wrong access controll check here:

if (_msgSender() != offerInfo.authority) {
revert Errors.Unauthorized();
}

Impact

It breaks the whole purpose of settleAskTaker function,

Seller cannot settle points, which means whatever collateral placed will be lost.

Buyer can call it but he has to give the point tokens to himself which doesn't make sense, Or choose to take the collateral of the seller which is not what he bought.

Tools Used

manual

Recommendations

Make this change in the settleAskTaker function:

if (status == MarketPlaceStatus.AskSettling) {
- if (_msgSender() != offerInfo.authority) {
+ if (_msgSender() != stockInfo.authority) {
revert Errors.Unauthorized();
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-settleAskTaker-wrong-stock-authority

Valid high severity, when taker offers are created pointing to a `offer`, the relevant `stockInfoMap` offers are created with the owner of the offer aka `authority`, set as the creater of the offer, as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L245). Because of the wrong check within settleAskTaker, it will permanently DoS the final settlement functionality for taker offers for the maker that listed the original offer, essentially bricking the whole functionality of the market i.e. maker will always get refunded the original collateral, and takers will never be able to transact the original points put up by the maker. This occurs regardless of market mode.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.