Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Seller can Manipulate the System to increase the likelihood that the Asset would be bought depriving other sellers.

krishnambstu

Summary

Before calling Swan.list() Seller can observe price provided by other sellers and can also examine Swan.assetsPerBuyerRound to determine how many assets are listed for that specific round of the buyerAgent and how far is it from SwanMarketParameters.maxAssetCount.

Vulnerability Details

For the Sell Phase of the buyerAgent, A seller can pick up all the data and can list the asset at the right time, at a right price to increase the likelikhood that this asset must be bought.

contract Attack{
Swan public swan;
BuyerAgent public buyerAgent;
uint256 timeUntilNextPhase;
uint256 minPrice = type(uint256).max;
uint256 maxAssetCount;
uint256 count;
uint256 round;
Phase phase;
constructor(address ad1,address ad2)
{
swan = Swan(ad1);
buyerAgent=BuyerAgent(ad2);
}
​
function ObserveBuyer() public{
//getting the round for the buyer Agent.
(round,phase,timeUntilNextPhase) = buyerAgent.getRoundPhase();
if(phase==Phase.Sell)
{
//getting the Listed Asset for that buyer for the specific round.
address Asset[]=swan.getListedAssets(buyerAgent,round);
//get the minimum price
for(uint256 i=0;i<Asset.length;i++)
{
if(swan.getListingPrice(Asset[i]) < minPrice)
minPrice= swan.getListingPrice;
}
//getting the max Asset count for the buyer.
maxAssetCount = swan.getCurrentMarketParameters().maxAssetCount;
count = swan.assetsPerBuyerRound[buyerAgent][round].length;
​
}
​
function listAsset() public{
if(count < maxAssetCount && block.timestamp < timeUntilNextPhase && phase==Phase.Sell)
swan.list(string calldata _name,
string calldata _symbol,
bytes calldata _desc,
minPrice-1,
buyerAgent);
}
​
}

The Seller Can observe all the listed asset price , timeUntilNextPhase, getCurrentMarketParameters().maxAssetCount > assetsPerBuyerRound[buyerAgent][round].length and decide the right moment and a low price (minPrice-1)

Though Oracle is a black box , providing decision for the buyerAgent, It is going to provide best option for the buyer . If we assume all different NFTs , which are Swan Assets are of same value then obviously the Seller is benefitted. And if The NFTs are of different values, then it is also possible to game the system.

Impact

The Likelihood is very high, And the impcat is also high from the perstive of Sellers who are deprived of.

Tools Used

Manul Review.

Recommendations

Developer should design the system such a way that seller can not pick others data before the round is finished.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.