Dria

Relevant Context

The Swan protocol allows users to list or relist assets that can be purchased by buyer agents. Each buyer agent has a maximum number of assets they can have listed to them per round (maxAssetCount). The listing process requires paying royalty fees that are calculated as a percentage of the listing price.

Finding Description

The list() function in the Swan contract allows an attacker to perform a denial of service attack on buyer agents by exploiting the asset count limit and royalty fee calculation.

The key issues are:

1. There is no minimum price requirement for listings

2. Royalty fees are calculated as a percentage of the price, meaning extremely low prices (1 wei) result in zero fees due to rounding

3. The maxAssetCount limit is enforced per buyer agent per round

4. Anyone can list assets to any buyer agent

An attacker can list the maximum number of assets allowed to a buyer agent with a price of 1 wei. Due to percentage-based calculations rounding down to 0, this costs the attacker virtually nothing in fees. Once the maximum number of assets is reached, legitimate sellers cannot list assets to that buyer agent for the entire round.

Impact Explanation

High. This attack can completely prevent legitimate sellers from listing assets to targeted buyer agents, effectively breaking core protocol functionality. The attack can be sustained cheaply across multiple rounds.

Likelihood Explanation

High. The attack is simple to execute, requires minimal capital, and has no significant barriers or risks for the attacker.

Proof of Concept

1. Attacker identifies a target buyer agent

2. Attacker determines the maxAssetCount for the current market parameters (e.g. 10)

3. Attacker calls list() 10 times with:

   • Price = 1 wei

   • Buyer = target buyer agent address

   • Minimal gas costs for name/symbol/description

4. The buyer agent's asset slot limit is reached for the round

5. Legitimate sellers trying to list assets to this buyer agent will have their transactions revert due to AssetLimitExceeded

6. Attacker can repeat for subsequent rounds at minimal cost

Recommendation

Implement one or more of the following protections:

1. Add a minimum listing price requirement:

2. Require a minimum fixed fee for listings regardless of price: