Tadle

Summary

In protect mode, when users listOffer(), the transferred collateral amount is calculated based on variable offerInfo.collateralRate. But when we update this offer's collateral rate, we use variable _collateralRate. Users can get profit via the difference between offerInfo.collateralRate and _collateralRate.

Vulnerability Details

The trader can resell the points via listOffer(). In protected mode, the trader resell the points with chosen price and collateralRate. The chosen price and collateralRate may be different with the pre offer.
The problem is that we calculate the collateral amount based on preOffer's collateral rate, and update the newly offerInfoMap's information with users input _collateralRate. The trader may get profit via the difference between offerInfo.collateralRate and _collateralRate.

For example:

• Alice creates one ask offer with collateral rate 120%.

• Bob creates one bid taker to match Alice's offer.

• Now Bob resell the points via listOffer() with collateral rate 200%. The actual collateral amount Bob adds into the capitalPool is amount * 120%. But the system will record the collateral wtih 200%.

• If bob closes the offer directly, the refund collateral amount will be calculated with collateral rate 200%. And bob can get more collateral than expected.

Impact

Traders can steal the funds in the capital pool via listOffer()/closeOffer() in protect mode.

Tools Used

Manual

Recommendations

In listOffer, the calculation of collateral amount should be based on the newly collateral rate _collateralRate.