Dria

Summary

Since the purchasefunction in BuyerAgent.solis callable by the operators, the operators can just list an asset at a very high price and call the purchasefunction. This would cause the operators to steal the buyers funds deposited.

Vulnerability Details

In the BuyerAgent.solthe authorized people are the owner and the operator. Therefore the operator can list a useless asset to the buyer at a high price and then proceed to purchase this asset. Which will result in the entire funds trasnferred to the operator.(except a part of the royaltyFee).

function purchase() external onlyAuthorized {
(https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/swan/BuyerAgent.sol#L222C1-L222C50)

Impact

Complete loss of funds to the user. But it is mentioned that the operator is trusted.(not sure what is the severity)

Tools Used

Manual Review

Recommendations

Make the purchase function accessible only to the owner.