Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect token balance type assigned for ask maker refund

robertodf99

Summary

In the DeliveryPlace::settleAskMaker function, ask makers send point tokens to the token manager and, in return, receive their collateral back. This collateral is then recorded in a mapping that classifies each user's balance into six different categories. The issue arises from the misclassification of the returned collateral, which is incorrectly categorized as sales revenue when it should be labeled as a maker refund:

tokenManager.addTokenBalance(
@> TokenBalanceType.SalesRevenue,
_msgSender(),
makerInfo.tokenAddress,
makerRefundAmount
);

Vulnerability Details

This misclassification can cause conflicts when interacting with the contract through the frontend interface. Specifically, it may display an inflated amount of claimable sales revenue, while the actual refunds available to the user are less than what they should be.

Impact

Refer to PoC below for an example:

function test_ask_offer_turbo_usdc() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
preMarktes.createTaker(offerAddr, 500);
​
address stock1Addr = GenerateAddress.generateStockAddress(1);
preMarktes.listOffer(stock1Addr, 0.006 * 1e18, 12000);
​
address offer1Addr = GenerateAddress.generateOfferAddress(1);
preMarktes.closeOffer(stock1Addr, offer1Addr);
preMarktes.relistOffer(stock1Addr, offer1Addr);
​
vm.stopPrank();
​
vm.prank(user1);
systemConfig.updateMarket(
"Backpack",
address(mockPointToken),
0.01 * 1e18,
block.timestamp - 1,
3600
);
​
vm.startPrank(user);
mockPointToken.approve(address(tokenManager), 10000 * 10 ** 18);
deliveryPlace.settleAskMaker(offerAddr, 500);
deliveryPlace.closeBidTaker(stock1Addr);
uint256 balanceMaker = tokenManager.userTokenBalanceMap(
user,
address(mockUSDCToken),
TokenBalanceType.MakerRefund
);
assertEq(balanceMaker, 0);
vm.stopPrank();
}

Tools Used

Manual review.

Recommendations

Add tokens to refund mapping instead of sales revenue:

tokenManager.addTokenBalance(
- TokenBalanceType.SalesRevenue
+ TokenBalanceType.MakerRefund,
_msgSender(),
makerInfo.tokenAddress,
makerRefundAmount
);
Updates

Lead Judging Commences

0xnevi Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-DeliveryPlace-settleAskMaker-addTokenBalance-wrong-TokenBalanceType

Valid low severity, while the token type inputted is wrong, userTokenBalanceMap is still incremented appropriately, so users can still withdraw their funds. So this would technically only affect accounting and public view functions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.