Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Any market taker with his own ask offer listed in turbo mode might call settleAskMaker, which would lead to stealing proctol found

meeve

Summary

  • Alice creates offer ask offer in turbo mode with 10_000 points for 10_000 USDC, collateralRatio 300%.

  • Mark calls createTaker for 10_000 points and then listOfferwith 5_000 points.

  • All his points are sold.

  • Tokens are released, so Alice calls settleAskMaker, so everyone are ready to fetch their points.

  • Mike calls closeBidTaker to get his portion of points ( 5_000 ).

  • Market token prices drops very low.

  • Mike calls settleAskMaker, where he sends 5_000 and retrieve the collateral worth of (5_000 * 300% = 15_000)

Vulnerability Details

That last action called my Mike should not be possible. For protection mode, every offer should be settled by his owner. That way everyone could collect their collateral. But for the Turbo mode, settlement is done only by the initial offer creator.

So it should be blocked for any others.

Impact

The market token price doesn't even have to fail. It is enough if it is lower than the collateral, which will almost always be the case. And then Mike will be able to abuse the system, which means stealing money from it.

Tools Used

Manual Review

Recommendations

This check should be present in settleAskMaker

if (offerInfo.offerType == OfferSettleType.Turbo && offerInfo.id != makerInfo.originOffer) {
revert InvalidOffer();
}
Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-Premarkets-listOffer-turbo-settleAskMaker-exploit-settlement

Valid high severity, this allows resellers listing offers via `listOffer/relistOffer` to game the system. Based on the inherent design of Turbo mode not requiring takers making ask offers for the original maker offer to deposit collateral, the wrong refund of collateral to takers even when they did not deposit collateral due to turbo mode during settleAskMaker allows possible draining of pools.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.