Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

There is no significant relationship between the collateral and the value of points to be listed

0x0noob

Description

function createOffer(CreateOfferParams calldata params) external payable {
if (params.points == 0x0 || params.amount == 0x0) {
revert Errors.AmountIsZero();
}
...
}

This function only requires that the params.amount is not zero and the value of params.amount was also used to determine to determine the amount of collateral that the protocol would take from users, but this collateral in no way reflects or is connected to the total value of the offer. For example, a user listing 10000000000000 points at 0.01 ether would be required to pay the same amount as a user listing 1000 points at same price. The implication of this is that bad actors might be willing to only release a little collateral which in no way reflects the value of his/her offer.

Source

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L39C5-L157C6

POC

function test_POC() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
vm.stopPrank();
vm.startPrank(user1);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000000000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
vm.stopPrank();
assertEq(mockUSDCToken.balanceOf(user), mockUSDCToken.balanceOf(user1));
}

user and user1 creates different offers of 1000 and 1 billion points but both seperately are charged same collateral.

Tools Used

Manual Review

Recommendations

The best mitigation against this would be to require a minimum collateral value which is based on the total value a user wishes to obtain from the offer placed.

Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.