Dria

Summary

The AssetLimitExceeded error in the Swan contract is inconsistently used, leading to confusion and potential misinterpretation by developers and users. In one instance, the error correctly includes the limit value, but in another, it incorrectly includes the current count of assets. This inconsistency can cause misunderstandings about the actual asset limit, potentially resulting in failed transactions or incorrect handling in applications that interact with the contract.

Vulnerability Details

The Swan contract defines an error to indicate when the asset count limit for a round has been exceeded:

This error expects the limit parameter, representing the maximum number of assets allowed per round (maxAssetCount).

Correct Usage in list Function:

In the list function, the error is used correctly. The function checks if the number of assets listed for a buyer in the current round has reached the maxAssetCount limit:

Here, if the asset count equals the maximum allowed, the function reverts with AssetLimitExceeded(getCurrentMarketParameters().maxAssetCount);, correctly passing the limit.

Incorrect Usage in relist Function:

In contrast, the relist function uses the error incorrectly:

Here, when the count exceeds the maxAssetCount, the function incorrectly reverts with AssetLimitExceeded(count);, passing the current count of assets instead of the limit.

Impact

The inconsistent use of the AssetLimitExceeded error can cause:

• Misinterpretation of Error Messages: Developers and users may misunderstand the actual asset limit, leading to incorrect assumptions and potentially flawed application logic.

• Failed Transactions: Users may experience unexpected transaction failures without clear understanding, resulting in poor user experience.

• Protocol Misuse: Applications interacting with the contract might handle the error improperly, causing bugs or vulnerabilities in downstream systems.

Tools Used

Manual Review

Recommended Mitigation

To resolve this issue, ensure that the AssetLimitExceeded error consistently includes the limit value. Specifically, update the relist function to pass the correct parameter:

Modify the relist Function:

By passing getCurrentMarketParameters().maxAssetCount to the AssetLimitExceeded error, you ensure consistency across the contract.