Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unauthorized Access on DeliveryPlace.sol :: closeBidOffer

sidhack3r11

Summary

This report highlights the unauthorized access vulnerability in the closeBidOffer function within the DeliveryPlace smart contract. This function allows unauthorized users to close bid offers, potentially leading to financial loss and market manipulation. The findings, potential impacts, and recommended mitigation measures are detailed below.

Vulnerability Details

The closeBidOffer function is designed to close a bid offer, refund the offer maker, and update the offer status. The function is defined as follows:

function closeBidOffer(address _offer) external {
(
OfferInfo memory offerInfo,
MakerInfo memory makerInfo,
,
MarketPlaceStatus status
) = getOfferInfo(_offer);
​
if (_msgSender() != offerInfo.authority) {
revert Errors.Unauthorized();
}
​
if (offerInfo.offerType == OfferType.Ask) {
revert InvalidOfferType(OfferType.Bid, OfferType.Ask);
}
​
if (
status != MarketPlaceStatus.AskSettling &&
status != MarketPlaceStatus.BidSettling
) {
revert InvalidMarketPlaceStatus();
}
​
if (offerInfo.offerStatus != OfferStatus.Virgin) {
revert InvalidOfferStatus();
}
​
uint256 refundAmount = OfferLibraries.getRefundAmount(
offerInfo.offerType,
offerInfo.amount,
offerInfo.points,
offerInfo.usedPoints,
offerInfo.collateralRate
);
​
ITokenManager tokenManager = tadleFactory.getTokenManager();
tokenManager.addTokenBalance(
TokenBalanceType.MakerRefund,
_msgSender(),
makerInfo.tokenAddress,
refundAmount
);
​
IPerMarkets perMarkets = tadleFactory.getPerMarkets();
perMarkets.updateOfferStatus(_offer, OfferStatus.Settled);
​
emit CloseBidOffer(
makerInfo.marketPlace,
offerInfo.maker,
_offer,
_msgSender()
);
}
​

The function relies on _msgSender() to determine if the caller is authorized to close the bid offer. The current access control mechanism checks if _msgSender() matches offerInfo.authority. However, if this check is bypassed or not implemented correctly, unauthorized users could potentially close bid offers they do not own.

Impact

The function relies on _msgSender() to determine if the caller is authorized to close the bid offer. The current access control mechanism checks if _msgSender() matches offerInfo.authority. However, if this check is bypassed or not implemented correctly, unauthorized users could potentially close bid offers they do not own.

System Disruption: Unauthorized closure of offers and triggering refund mechanisms can disrupt normal operations, leading to inconsistencies and eroding trust in the system.

Tools Used

Manual Review

Recommendations

Implement Robust Access Controls: Utilize access control libraries or modifiers to ensure only authorized users can call sensitive functions. For example:

modifier onlyOfferAuthority(address _offer) {
(, MakerInfo memory makerInfo, , ) = getOfferInfo(_offer);
require(_msgSender() == makerInfo.authority, "Unauthorized");
_;
}
​
Updates

Lead Judging Commences

0xnevi Lead Judge
11 months ago
0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.