Dria

Vulnerability Details

A malicious user can create a BuyerAgent with a high amountPerRound but never fund it, creating a honeypot that:

1. Attracts sellers with the high purchasing power display

2. Collects royalty fees from sellers who list assets

3. Never actually purchases any assets due to lack of funds

The issue occurs because:

1. BuyerAgent creation has no funding requirement:

Swan.sol#L323-L336

2. Sellers pay royalty fees upfront when listing:

Swan.sol#L187-L188

3. The BuyerAgent's amountPerRound is publicly visible and used to attract sellers, but there's no guarantee the contract actually has these funds.

Impact

• Sellers lose money by paying royalty fees to malicious buyers who never intend to purchase

• The protocol's reputation is damaged as sellers lose trust in buyers

• Economic incentives are broken as malicious buyers can profit without providing value

• Sellers waste gas deploying assets and listing them

Recommendations

Require minimum funding when creating a BuyerAgent.