Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

BuyerAgent owner can decrease balance below `amountPerRound`

zxriptor

Summary

Repeated requests to the oracle within a single phase may result in the BuyerAgent's balance falling below the amountPerRound threshold.

Vulnerability Details

The protocol defines minimal fund amount as amountPerRound plus oracle fee:

https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/swan/BuyerAgent.sol#L153

/// @notice The minimum amount of money that the buyer must leave within the contract.
/// @dev minFundAmount = amountPerRound + oracleTotalFee
function minFundAmount() public view returns (uint256) {
return amountPerRound + swan.getOracleFee();
}

This is enforced in withdraw function effectively preventing the balance fall below the minimum amount when the BuyerAgent is not in Withdraw phase:

https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/swan/BuyerAgent.sol#L270-L272

// if we are not in Withdraw phase, we must leave
// at least minFundAmount in the contract
if (phase != Phase.Withdraw) {
// instead of checking `treasury - _amount < minFoundAmount`
// we check this way to prevent underflows
if (treasury() < minFundAmount() + _amount) {
revert MinFundSubceeded(_amount);
}
}

It is important to note that the formula used in minFundAmount is enough to cover 1 call to oracle per round. However, nothing prevents a user to call oracle multiple times using oracleStateRequest or oraclePurchaseRequest depending on the phase.

Considering an example where a user had exactly amountPerRound + oracleFee balance at the beginning of the phase:

  • first call to oraclePurchaseRequest will leave amountPerRound on the balance

  • second call to oraclePurchaseRequest will leave amountPerRound - oracleFee on the balance

Impact

A constraint imposed by minFundAmount can be breached. Subsequently, this can lead to the purchase call reversal due to insufficient funds since oracles are expected to compose a purchase list up to amountPerRound.

Tools Used

Manual review

Recommendations

Prohibit duplicate requests to oracles at the same phase or enforce minFundAmount() check during such calls.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

zxriptor Submitter
12 months ago
inallhonesty Lead Judge
11 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.