Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Slippage Protection in Settlement Functions

bauchibred

Summary

The DeliveryPlace contract's settleAskMaker and settleAskTaker functions lack slippage protection mechanisms. This omission can lead to unfavorable trades for users in volatile market conditions, potentially resulting in significant financial losses.

Vulnerability Details

The vulnerability stems from the use of a fixed tokenPerPoint value when calculating the settled amount, without considering market price fluctuations between offer creation and settlement.

See

function settleAskMaker(address _offer, uint256 _settledPoints) external {
// ... (other code)
​
uint256 settledPointTokenAmount = marketPlaceInfo.tokenPerPoint * _settledPoints;
​
ITokenManager tokenManager = tadleFactory.getTokenManager();
if (settledPointTokenAmount > 0) {
tokenManager.tillIn(
_msgSender(),
marketPlaceInfo.tokenAddress,
settledPointTokenAmount,
true
);
}
​
// ... (rest of the function)
}

Similarly, in the settleAskTaker function:

function settleAskTaker(address _stock, uint256 _settledPoints) external {
// ... (other code)
​
uint256 settledPointTokenAmount = marketPlaceInfo.tokenPerPoint * _settledPoints;
ITokenManager tokenManager = tadleFactory.getTokenManager();
if (settledPointTokenAmount > 0) {
tokenManager.tillIn(
_msgSender(),
marketPlaceInfo.tokenAddress,
settledPointTokenAmount,
true
);
​
// ... (rest of the function)
}
}

In both functions, marketPlaceInfo.tokenPerPoint is used as a fixed value to calculate the settled amount. This approach doesn't account for potential market price changes between the time an offer is made and when it's settled.

Impact

The lack of slippage protection can lead to several negative outcomes:

  1. Financial losses for users due to unfavorable trade execution in volatile markets.

  2. Potential for market manipulation, where malicious actors could exploit price fluctuations to their advantage.

  3. Reduced user trust in the platform due to unexpected trade outcomes.

  4. In extreme cases, significant value loss for the protocol if large trades are executed at unfavorable rates.

Tools Used

Manual review

Recommendations

Modify the settlement functions to accept a minimum acceptable rate parameter:

pseudo fix below

function settleAskMaker(address _offer, uint256 _settledPoints, uint256 _minTokenPerPoint) external {
// ... existing checks ...
​
uint256 currentTokenPerPoint = getCurrentTokenPerPoint(); // Implement this function
require(currentTokenPerPoint >= _minTokenPerPoint, "Slippage exceeded");
​
uint256 settledPointTokenAmount = currentTokenPerPoint * _settledPoints;
​
// ... rest of the function ...
}

Also consider implementing a getCurrentTokenPerPoint() function that fetches the current market rate from a reliable oracle or price feed.

Add similar protection to the settleAskTaker function.

Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.