Canto Application Specific Dollars and Bonding Curves for 1155s - codynhat's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L290

Vulnerability details

Impact

In Market.sol, fees are split between the creator of a share, shareholders, and the platform. Due to a rounding issue, the total amount of fees split among these beneficiaries does not always sum to the fee collected. In addition, there is no way to withdraw this extra amount, resulting in the funds being stuck in the contract forever.

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L290

Proof of Concept

The following is a test case added to Market.t.sol demonstrating funds accumulating.

function testAccumulatingToken() public {
    testCreateNewShare();

    token.mint(alice, 1e18);

    (uint256 outstandingPrices, ) = market.getBuyPrice(1, 10);

    vm.prank(alice);
    token.approve(address(market), 1e18);

    // Buy 10 shares
    token.approve(address(market), 1e18);
    market.buy(1, 10);

    // Everyone claims
    market.claimHolderFee(1);

    market.claimPlatformFee();

    vm.prank(bob);
    market.claimCreatorFee(1);

    for (uint256 i = 0; i < 10; i++) {
        // Alice buys and sells a share, distributing a fee
        vm.prank(alice);
        market.buy(1, 1);

        vm.prank(alice);
        market.sell(1, 1);
        
        // Everyone collects their fees
        vm.prank(alice);
        market.claimHolderFee(1);

        market.claimHolderFee(1);
        market.claimPlatformFee();

        vm.prank(bob);
        market.claimCreatorFee(1);

        // Balance should be == outstandingPrices, but has actually accumulated some tokens
        console.logUint(token.balanceOf(address(market)) - outstandingPrices);
    }

    assertEq(token.balanceOf(address(market)) - outstandingPrices, 0);
}

Tools Used

Manual review

Recommended Mitigation Steps

The platformFee should be updated to include this excess amount in the calculation, just like it includes the remainder after shareHolderFee and shareCreatorFee.

https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L287

Assessed type

Math