Dria

Summary

Failed or unfinished purchases are beyond sellers control, however when such unfortunate events happen, they still face royalty fees.

Vulnerability Details

The protocol collects royalty fees from sellers upfront during the Swan.sol::list() call: https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/swan/Swan.sol#L188. This mechanism is designed to prevent sellers from abusing buyers with worthless assets. However, issues may arise if operators or the buyer's owner fail to complete the purchase before the Buy phase ends, due to network conditions, software errors, or malicious intent. In such cases, the royalty fees remain in the BuyerAgent contract balance, and sellers do not receive refunds.

Impact

Sellers incur royalty fees even for failed or incomplete purchases, effectively being penalized for circumstances beyond their control. This discourages their participation in trades.

Tools Used

Manual Review

Recommendations

Award royalty fees to buyers only after purchase is completed, refund sellers if purchase failed or was not executed