Tadle

Summary

In the DeliveryPlace::settleAskMaker() function, if the offerInfo.usedPoints is zero, the function calculates a refund amount for the maker’s collateral tokens. However, when the function is called by the contract owner, the refund is mistakenly sent to the contract owner’s address instead of the maker's authority.

Vulnerability Details

The settleAskMaker() function allows the contract owner to settle an ask maker’s offer if provided _settledPoints is zero:

In this case, if the offerInfo.usedPoints is zero, no points are used, and the function calculates a makerRefundAmount to refund the maker’s collateral tokens.

However, the refund is incorrectly allocated to the _msgSender(), which is the contract owner when he calls the function:

This results in the collateral tokens being sent to the contract owner instead of the offerInfo.authority.

Impact

This vulnerability allows the contract owner to improperly receive collateral refunds that belong to the authority of offer.

Tools Used

vscode

Recommendations