Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of cap on `amountPerRound` could lead to overflow in `minFundAmount` calculation

iampukar

Summary

The setAmountPerRound function allows the contract owner to set the amountPerRound value without enforcing an upper limit. This absence of a ceiling permits the owner to assign an arbitrarily large value to amountPerRound, which governs the maximum funds a buyer agent can spend per round.

function setAmountPerRound(uint256 _amountPerRound) external onlyOwner {
_checkRoundPhase(Phase.Withdraw);
amountPerRound = _amountPerRound;
}

https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/swan/BuyerAgent.sol#L393

Vulnerability Details

/// @notice The minimum amount of money that the buyer must leave within the contract.
/// @dev minFundAmount = amountPerRound + swan.getOracleFee()
function minFundAmount() public view returns (uint256) {
return amountPerRound + swan.getOracleFee();
}

The minFundAmount function calculates the minimum required funds as the sum of amountPerRound and the oracle fee obtained from the Swan contract. Although Solidity version ^0.8.0 inherently protects against arithmetic overflows by reverting transactions on overflow conditions, the lack of explicit validation or caps on either amountPerRound can lead to scenarios where minFundAmount could become unreasonably large.

Impact

The issue require ownership privileges, limiting their exploitability to malicious owners or those who have compromised ownership keys, or an owner who mistakenly has set larger amount per round. However, if exploited, the impact is substantial as it can disrupt the interactions within the Swan ecosystem.

Tools Used

Manual Review

Recommendations

Introduce a maximum allowable value for amountPerRound within the BuyerAgent contract to prevent it from being set to excessively high values.

​
function setAmountPerRound(uint256 _amountPerRound) external onlyOwner {
_checkRoundPhase(Phase.Withdraw);
+ require(_amountPerRound <= MAX_AMOUNT_PER_ROUND, "Amount per round exceeds maximum limit");
amountPerRound = _amountPerRound;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.