Dria

Summary

in the buyeragent.sol the contract allows the buyer to withdraw tokens from the contract if the current phase is withdraw the buyer can withdraw tokens from the contract however a vulnerability allows the buyer to withdraw any amount of tokens with no check in place

Vulnerability Details

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/swan/BuyerAgent.sol#L258-L276

as we can see if the current phase is withdraw the code allows buyer to withdraw any amount of tokens with no check on the amount this is problematic as the buyer can withdraw any amount of tokens and completely drain the contract

Impact

loss of funds for contract

Tools Used

none

Recommendations

Only allow the buyer to withdraw tokens they are entitled to, and implement checks to ensure the buyer does not withdraw more than that