Dria

Summary

Swan protocol's listing mechanism allows malicious actors to manipulate asset listings through unvalidated buyer addresses and round/phase exploitation. An attacker can create artificial market conditions by exploiting the round-based validation system, potentially leading to unauthorized asset control and market price manipulation.

1. The function accepts any address as _buyer without validating if it's a legitimate BuyerAgent

2. There's no check if the buyer address exists or is active before casting to BuyerAgent

3. The contract assumes the buyer is valid just by attempting to call getRoundPhase()

Vulnerability Details

The core vulnerability exists in the listing logic where buyer validation and round management are insufficiently protected: https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/swan/Swan.sol#L157-L191

Impact

• Market manipulation through artificial round progression

• Unauthorized asset listings through fake buyer contracts

• Price manipulation across rounds

Recommendations

• Implement a buyer registry with proper validation

• Add round progression controls

• Implement price validation across rounds

• Add atomic operation support for listing creation