Tadle

Summary

A Denial of Service (DOS) vulnerability has been identified in the `OfferSettleType.Turbo` implementation. This issue prevents users from listing their purchased tokens at prices above the market rate, contradicting the intended functionality as described in the documentation. As a result, users are unable to list their tokens as desired, leading to a restricted user experience.

Vulnerability Details

According to the implementation and the documentation, users should be able to purchase tokens for a certain price (e.g., $1) and list them for a higher price (e.g., $1.10 or $2), regardless of the `OfferSettleType`. The documentation explicitly mentions:

> **"Step 5: Select Collateral Rate: Depending on Mode type, you can set a dynamic collateral option."**

https://tadle.gitbook.io/tadle/product/points-marketplace/sell-points#:~:text=Step 5%3A,dynamic collateral option.

However, the current implementation includes the following check:

This code prevents users who purchase a Turbo offer from listing their tokens above the market price, as the function will revert if the `collateralRate` differs from the original offer. This restriction effectively leads to a Denial of Service (DOS) for users who wish to list their tokens at a different price, as they are unable to do so.

Impact

This vulnerability restricts users from listing their tokens at desired prices, directly contradicting the intended functionality outlined in the documentation. As a result, users are denied service, potentially leading to dissatisfaction and a loss of trust in the platform. Additionally, this limitation can hinder market dynamics, as users are unable to participate fully in price-setting.

Tools Used

- Manual code review

Recommendations

To mitigate this issue, it is recommended to remove or modify the part of the code that enforces the collateral rate check. Users should be allowed to list their tokens at any collateral rate they desire, in line with the flexibility described in the documentation.