Dria

Swan
NFTHardhat
21,000 USDC
View results
Submission Details
Severity: low
Invalid

`maxAssetCount` check uses `==` instead of `>=`

Description

One of the invariants in the protocol in marketParameters is the maxAssetCount, where the buyer can't list items to a single buys that exceed this number (maxAssetCount) per round.

Before listing we check that the listed items don't exceed this variable.

swan/Swan.sol#L168-L170

function list( ... ) external {
...
>> if (getCurrentMarketParameters().maxAssetCount == assetsPerBuyerRound[_buyer][round].length) {
revert AssetLimitExceeded(getCurrentMarketParameters().maxAssetCount);
}
...
assetsPerBuyerRound[_buyer][round].push(asset);
}

The invariant checks is implemented with strick equality sign, which is not ideal, where it is better to use >= in case of changing maxAssetCount situations

Recommendations

use >= instead of ==

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[INVALID] List unlimited items

SwanManager::setMarketParameters pushes the new parameters `marketParameters.push(_marketParameters);` After that, when user calls list the protocol computes the round and the phase `(uint256 round, BuyerAgent.Phase phase,) = buyer.getRoundPhase();` Inside the getRoundPhase function you have this if statement on top: `if (marketParams.length == marketParameterIdx + 1) {`. The setMarketParameters call changed the `marketParams` length, thing which will case the first case to be false and run the else statement. At the end of that statement we see there is a new round. So the second element of this check `(getCurrentMarketParameters().maxAssetCount == assetsPerBuyerRound[_buyer][round].length` is zero, because the [round] is fresh.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.