Tadle

Summary

In Turbo mode, malicious traders can exploit the lack of collateral requirements for subsequent trades by listing offers with extremely high amounts. If no takers accept the offer, the trader can settle with zero points and receive a refund for collateral they never deposited, leading to significant protocol drain.

Vulnerability

In Turbo Mode, the original seller deposits crypto as collateral, enabling subsequent traders to buy and sell points without additional collateral. Malicious traders can approach as follows to drain the protocol funds:

1. The malicious trader accepts (buys) an ask offer in Turbo mode, which creates a stock for them.

2. The malicious trader then calls listOffer to list their points for sale at an extremely large _amount.

   2.1 Since the original offer's type is Turbo, the malicious trader is not required to deposit collateral for the amount they are selling

3. The market owner updates the market's information and sets the TGE event. Given the unrealistic high price set by the malicious trader, it is very likely that there will be no takers for their offer.

4. During the settlement period, the malicious trader calls DeliveryPlace::settleAskMaker to settle their ask offer with _settledPoints set to 0 (since no points were bought from their offer).

   4.1 Because _settledPoints equals offerInfo.usedPoints (0), and the malicious offer's status is Virgin (no takers), the function will erroneously refund the trader with the deposited collateral that they never actually deposited:

   function settleAskMaker(address _offer, uint256 _settledPoints) external {

   // ...

   uint256 makerRefundAmount;

   if (_settledPoints == offerInfo.usedPoints) {

   if (offerInfo.offerStatus == OfferStatus.Virgin) {

   // if there were no sub offers, refund the whole amount

   makerRefundAmount = OfferLibraries.getDepositAmount(

   offerInfo.offerType,

   offerInfo.collateralRate,

   offerInfo.amount,

   true,

   Math.Rounding.Floor

   );

   } else {//...}

   ​

   // @audit refunding the malicious user with LARGE collateral he did NOT deposit

   tokenManager.addTokenBalance(

   TokenBalanceType.SalesRevenue,

   _msgSender(),

   makerInfo.tokenAddress,

   makerRefundAmount

   );

   }

   // ...

   }

5. The malicious trader can then call TokenManager::withdraw to withdraw the very LARGE refunded collateral that he never deposited, effectively draining the protocol.

By setting an extremely high _amount for the points they are selling, the malicious trader can drain large sums of the protocol's funds.

Proof Of Concept

To reproduce to test below, some parts of the codebase need to be updated given that there are another vulnerability connected here:

1. Fix the vulnerability that allows users to keep withdrawing in TokenManager::withdraw (explained in details in another report):

The following test case demonstrates how Bob can easily drain $200_000 from the protocol (and potentially more):

Impact

Malicious traders can exploit Turbo mode to drain the protocol's funds by listing offers with extremely high amounts and settling without any actual takers, leading to a significant loss of funds.

Tools Used

Manual Review

Recommendations

The current implementation incorrectly refunds the collateral in Turbo mode in which no collateral was deposited.
Refunding collateral if there were no takers should be in either cases:

1. The original offer

2. Subsequent offer with Protected mode since they already deposited the collateral to be refunded.

Update the settleAskmaker function as follows