Dria

Summary

BuyerAgent need to keep the treasury() >= minFundAmount() when buyer agent doesn't in withdraw phase.

But if contract swan changed oracle parameter, it may cause the amount swan.getOracleFee() larger than before, cause treasury() < minFundAmount()

Vulnerability Details

the function minFundAmount()return the min amount token that buyer agent should have in phase sell and buy.

If swan changed oracle parameter, the swan.getOracleFee()may larger than before.

Because there is no limit about when the swan operator should change the oracle parameter.

Then the buyer agent will fail when pay oracle fee or buy list asset, may also cause the asset owner to lost fee.(Because they would lost buyer fee if buyer agent can't buy it at this round).

Impact

buyer agent may failed to act because there is no enough balance in contract.

this issue may also cause the asset owner lost fee.

Tools Used

mannul review

Recommendations

delay the oracle change to next round