Tadle

Vulnerability Details

When creating a marketplace, the owner sets the fixed ratio for the market:

Once the market is created, the fixedratio cannot be updated. Offer makers can list their offers, and trading activities can proceed regardless of the fixedratio value. However, during the settlement period, if the marketplace's fixedratio is set to true, point settlements become impossible, as seen in DeliveryPlace::settleAskTaker and DeliveryPlace::settleAskMaker:

The above code reveals a contradiction in the protocol's behavior. On one hand, the protocol permits trading activities in markets where fixedratio is set to true, but on the other hand, it neither offers a possibility for the owner to update the fixedratio to false nor permits the settlement of points when fixedratio is true.

Impact

If a marketplace's fixedratio is set to true upon creation, settlement of points becomes impossible, leading to several issues:

1. Token points cannot be settled, preventing bid offer makers and ask offer takers from receiving their token points.

2. Ask makers and bid takers will lose their collateral since they are unable to settle the points.

Tools Used

Manual Review

Recommendations

There is an inconsistency in the functionality of the fixedratio. Below are some suggested approaches to address this issue:

1. Allow the owner to update the fixedratio to false in SystemConfig::updateMarket, to enable settlements under the current implementation.

2. If fixedratio is not supported in the current version, prevent the owner from setting fixedratio to true when creating the market.

3. If fixedratio is intended to be supported, implement the necessary logic in DeliveryPlace::settleAskTaker and DeliveryPlace::settleAskMaker to handle cases where fixedratio is set to true.