Dria

Summary

The malicious user can register a buyer agent that breaks the protocol invariants as long as the agent follows a normal agent's interface

Vulnerability Details

When registering a new agent the user passes in a fee. The fee rate is paid by the asset creators as a % of the listing price to the agent.

In the constructor of the buyer agent there is this check which requires the fee to be between 1 and 99 % incluside.

When listing an asset for sale the address of the buyer is passed and as long as it complies with the `BuyerAgent` interface the transaction would succeed. This lets a malicious user create an agent where the fee is 100 % and leave no winnings for the seller.

Just fee for the protocol would be taken out.

In the later case the malicious user could set the fee to 0 % and then no winning go to the protocol/dria.

Impact

Core invariant broken

Tools Used

Manual review

Recommendations

Create a mapping of address => bool that stores the newly created byer agent address and wheter he is valid. Add a modifier the the functions that are callable by the agent to require the msg.sender to be be a registered byer. That way only buyer agents deployed by the protocol would be able to execute functions.