Tadle

Summary

There is a missing check in the DeliveryPlace.settleAskMaker() function that rechecks if the offer's settlement type is Protected or if the offer is a Turbo market origin offer.

Without this check, anyone can trick the system into extracting collateral from an offer created from a Turbo original offer.

Vulnerability Details

Offers created from a Turbo offer are not required to deposit collateral in the same way as offers in a Protected market. This is important to remember when a function within a system is performing a refund of collateral during its execution.

As seen in the PreMarkets.closeOffer() function, the check to not refund for non-origin Turbo offers is in place:

But this important check is missed in the DeliveryPlace.settleAskMaker() function. This can be leveraged by an attacker; here's how:

1. An attacker, as a Taker, takes an Ask offer from a Turbo market for 1 USDC.

2. The attacker relists that offer with an unrealistic valuation of 10,000 USDC. They are not obligated to deposit any collateral, and no one will take such an offer from them.

3. When the time of TGE arrives, they will leverage the issue in the DeliveryPlace.settleAskMaker() function.

4. After calling it, as shown in the code below, they will be refunded:

As can be seen, the attacker can wait right before any TGE, craft a Turbo market, create Ask offers as a Maker, and take them as a Taker with inflated collateral in the relisted offers. They can reproduce this for any whitelisted token and, after the TGE, drain all funds from the CapitalPool contract.

Impact

This vulnerability can result in the loss of all funds from the CapitalPool contract.

Tools Used

Manual review.

Recommendations

Add a check in the DeliveryPlace.settleAskMaker() function to ensure that offers are not Turbo and, if they are, only allow the settlement of the original offer.