Pieces Protocol

Summary:

TokenDivider is missing a "require" check in the function "sellErc20" that can exploit the "price" to sell the tokens at without paying for them.

Vulnerability Details:

Affected code lines 221-242

relates back to "price" having no require statement in the function "sellErc20()" which can lead to a loss of contract integrity, meaning that it breaks assumptions made elsewhere in the codebase wherever it is used for calculations and is a business logic flaw. Price manipulation then becomes possible because there is no set price for the "price" to sell at and a malicious actor could create malicious "sell orders" and drain the tokens from the "buy" orders.

Impact:

High

1. Price manipulation

2. Contract integrity loss

Tools Used:

Foundry

Recommendations:

include a "require" in the function "sellErc20()" check to ensure that a price is set for the tokens in the function and it functions correctly throughout its use places in the smart contract.