Dria

Summary

In the Swan contract list function, assets can be listed for a price of zero. This enables a malicious user to exploit the lack of a minimum price by filling the maxAssetCount limit with worthless assets, effectively blocking the buyer from accessing valuable assets and preventing other users from listing assets for that buyer in the same round. This exploit limits the buyer's options and disrupts other users’ ability to participate.

Vulnerability Details

The vulnerability exists in the list function of the Swan contract, where there is no restriction on the minimum price for assets that can be listed. This absence of a minimum price allows a malicious user to repeatedly list assets at 0 price. By doing so, the malicious user can fill the maxAssetCount limit for a given BuyerAgent with assets that hold no real value.

This action effectively prevents the buyer from accessing assets they may actually need, leaving them only with spam listings that provide no utility. Additionally, this setup blocks honest users from listing their assets for the same buyer in the current round, as the asset limit has already been met with valueless entries. This exploit not only causes grief to the buyer by limiting their options to spam assets but also impacts other users by preventing them from participating in the asset listing process for that buyer.

PoC

To demonstrate this vulnerability, we create a mock ERC20 token (MockERC20) to serve as the token used in the Swan protocol.

Then, we set up the test file as shown below.

In the test file TestVuln, a malicious user is able to list multiple assets with a price of zero, allowing them to avoid paying any protocol fees. By listing assets with a zero price, this malicious user fills the maxAssetCount limit — the maximum number of assets that can be listed for a given BuyerAgent in one round. As a result, the BuyerAgent is left with assets of no value, effectively preventing them from acquiring any assets they might actually want or could use. Additionally, this prevents other users from selling assets to this BuyerAgent.

*Remove _disableInitializers() from the Swan and SwanManager contracts in order for this test code to work.

After running the test with forge test, we can observe that the test passes, indicating that the vulnerability is present and can be exploited to grief the buyer and other users.

Impact

The impact of this vulnerability is that malicious users, due to the lack of a minimum price requirement for assets, can spam listings of assets with no value. By setting the price of these assets to zero, they can list them without paying any protocol fees. This fills the maxAssetCount limit for a given BuyerAgent, effectively preventing buyers from purchasing valuable assets that align with their needs or preferences, as the available asset slots are occupied by spam listings. Additionally, this prevents other users from listing assets for the same buyer in the current round.

Tools Used

• Manual Code Review

• Foundry

Recommendations

Consider adding a minimum price requirement in the list and relist function. This requirement would create a cost barrier, disincentivizing malicious users from exploiting the system by requiring them to pay a protocol fee as well, making spam or griefing attacks less appealing.