Dria

Summary

In Swan a listing's asset's price can exceed buyer's amountPerRound rendering such a listing useless and not purchasable.

Vulnerability Details

Every buyer has his own amountPerRound value set on deploy. This is the maximum amount that the buyer agent can spend per round. However, in Swan::list and Swan::relist when a listing is made this amount is not checked. This leads to listings which can have higher price than the buyer's amountPerRound which will lead to such listings being useless and not purchasable.

Impact

This vulnerability causes the system to have redundant listings. Such listings will not be purchasable but the fees for them will be already paid when listing/relisting them.

Tools Used

Manual Review

Recommendations

When performing a Swan::list or Swan::relist functions check whether the price exceeds the buyer's current amountPerRound and if so revert the transaction with the appropriate error.