Summary

An attacker can use the list() function to create assets with _price = 0, avoiding any fees. By creating many such listings, the attacker can fill up the buyer’s maxAssetCount limit, preventing them from buying assets from other users.

Vulnerability Details

This mapping in swan.sol is used to ensure that buyers do not exceed the maxAssetCount when listing or relisting assets.

If a buyer agent has a low royaltyFee, or while creating an asset _price = 0 fee will be zero so an attacker could create many listings for that buyer. This would allow the buyer to reach the maxAssetCount limit, preventing them from purchasing assets from other users.

if the _price = 0 while creating a list the buyerFee and driaFee also, becoming Zero means an attacker can create unlimited assets to prevent others from selecting him for buying assets.

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/swan/Swan.sol#L177C1-L181C1

https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/swan/Swan.sol#L168

Impact

The buyer will be unable to purchase necessary assets, and other users won’t be able to select the buyer for their assets either.

Recommendations

There are two ways to solve this issue:

1- A minimum price for a listing

2- adding a restriction to limit the number of assets a user can list for each buyer in a given round.