Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Ask offers cannot be settled for the `wrappedNativeToken`

100HP

Summary

When settleAskMaker() is called, offers with marketPlaceInfo.tokenAddress == wrappedNativeToken will generally revert due to a missing msg.value when calling tillIn().

Vulnerability Details

Ask offer generally settled by the DeliveryPlace::settleAskMaker(), it required caller to sent enough funds to the TokenManager via tillIn() function. Since the tokenManager also support wrappedNativeToken, an offer can initially created with tokenAddress same as wrappedNativeToken via createOffer().

The issue occurs when the settleAskMaker() trying to sent native token but due to missing msg.value to tillIn(), the funds not get transferred to tokenManager. As a result, tokenManger reverts txn with NotEnoughMsgValue error.

if (settledPointTokenAmount > 0) {
tokenManager.tillIn(
_msgSender(),
marketPlaceInfo.tokenAddress,
settledPointTokenAmount,
true
);
}
function tillIn(
address _accountAddress,
address _tokenAddress,
uint256 _amount,
bool _isPointToken
)
external
payable
onlyRelatedContracts(tadleFactory, _msgSender())
onlyInTokenWhiteList(_isPointToken, _tokenAddress)
{
...snip...
if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @notice check msg value
* @dev if msg value is less than _amount, revert
* @dev wrap native token and transfer to capital pool
*/
if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);
}
...snip...
}

Impact

Once ask offers created, it cannot be settled.

Tools Used

Manual review

Recommendations

Modify L267 and L377,

if (settledPointTokenAmount > 0) {
- tokenManager.tillIn(
+ tokenManager.tillIn{value: msg.value}(
_msgSender(),
marketPlaceInfo.tokenAddress,
settledPointTokenAmount,
true
);
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-PreMarkets-settleAskMaker-settleAskTaker-no-msg.value-sent

Invalid, in `settleAskMaker` and `settleAskTaker` you are settling the point token to be given to the takers, which is an ERC20 token, so no native ETH is involved and thus no msg.value is required.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.