Title

Buyer Listing DoS Through Zero-Price Asset Spam

Summary

A vulnerability has been identified in the Swan smart contract where malicious actors can prevent legitimate sellers from listing assets for a specific buyer by flooding the system with zero-price listings up to the maximum asset count limit.

Vulnerability Details

In Swan.sol:168, the contract validates that a seller cannot add a listing if the maxAssetCount for that particular buyer has been reached, which it's shared between all asset sellers, but it fails to properly validate listing conditions, allowing an attacker to exploit the listing system. The relevant code section checks the asset count limit:

The vulnerability exists because:

1. There is no minimum price requirement for listings

2. Listings with zero price don't incur fees

3. The system only enforces a maximum asset count per buyer per round

4. No limit exists on how many zero-price assets a single seller can list

An attacker can:

1. Create multiple listings priced at 0 for a target buyer

2. Fill up the entire maxAssetCount quota for that buyer's round

3. Effectively block legitimate sellers from listing assets

Impact

The impact of this vulnerability is severe:

• Legitimate sellers are prevented from listing assets

• Buyers cannot receive legitimate listings due to spam

• Market functionality is compromised for targeted buyers

• Potential for market manipulation and unfair competition

Tools Used

Manual Review

Recommendations

To address this vulnerability, consider implementing the following measures:

1. Minimum Price Requirements

   • Implement a minimum price threshold for listings

   • Ensure the minimum price covers at least the platform fees

   if (_price < minimumListingPrice) {

   revert PriceBelowMinimum(minimumListingPrice);

   }

2. Seller Listing Limits

   • Add per-seller limits for each buyer's round

   mapping(address => mapping(address => mapping(uint256 => uint256))) sellerListingsPerBuyerRound;

   ​

   function list(...) external {

   // ... existing checks ...

   if (sellerListingsPerBuyerRound[msg.sender][_buyer][round] >= maxListingsPerSeller) {

   revert SellerListingLimitExceeded();

   }

   sellerListingsPerBuyerRound[msg.sender][_buyer][round]++;

   }

3. Listing Fees

   • Require a listing fee regardless of asset price

   • This creates an economic disincentive for spam listings

   uint256 listingFee = calculateListingFee(_price);

   if (listingFee < minimumListingFee) {

   listingFee = minimumListingFee;

   }

   token.transferFrom(msg.sender, address(this), listingFee);