Omniscia Boson Protocol Audit

OfferHandlerFacet Manual Review Findings

OfferHandlerFacet Manual Review Findings

OHF-01M: Inexistent Re-Entrancy Protection

TypeSeverityLocation
Language SpecificOfferHandlerFacet.sol:L107

Description:

The createOfferBatch function does not provide re-entrancy protection in contrast to the createOffer function.

Impact:

A re-entrancy during the creation of an offer can cause a corrupted order to be stored and potentially exploited via another, nonReentrant protected pathway of the Boson Protocol.

Example:

contracts/protocol/facets/OfferHandlerFacet.sol
55function createOffer(
56 Offer memory _offer,
57 OfferDates calldata _offerDates,
58 OfferDurations calldata _offerDurations,
59 uint256 _disputeResolverId,
60 uint256 _agentId
61) external override offersNotPaused nonReentrant {
62 createOfferInternal(_offer, _offerDates, _offerDurations, _disputeResolverId, _agentId);
63}
64
65/**
66 * @notice Creates a batch of offers.
67 *
68 * Emits an OfferCreated event for every offer if successful.
69 *
70 * Reverts if:
71 * - The offers region of protocol is paused
72 * - Number of offers exceeds maximum allowed number per batch
73 * - Number of elements in offers, offerDates and offerDurations do not match
74 * - for any offer:
75 * - Caller is not an operator
76 * - Valid from date is greater than valid until date
77 * - Valid until date is not in the future
78 * - Both voucher expiration date and voucher expiraton period are defined
79 * - Neither of voucher expiration date and voucher expiraton period are defined
80 * - Voucher redeemable period is fixed, but it ends before it starts
81 * - Voucher redeemable period is fixed, but it ends before offer expires
82 * - Fulfillment period is set to zero
83 * - Resolution period is set to zero
84 * - Voided is set to true
85 * - Available quantity is set to zero
86 * - Dispute resolver wallet is not registered, except for absolute zero offers with unspecified dispute resolver with unspecified dispute resolver
87 * - Dispute resolver is not active, except for absolute zero offers with unspecified dispute resolver
88 * - Seller is not on dispute resolver's seller allow list
89 * - Dispute resolver does not accept fees in the exchange token
90 * - Buyer cancel penalty is greater than price
91 * - When agent ids are non zero:
92 * - If Agent does not exist
93 * - If the sum of Agent fee amount and protocol fee amount is greater than the offer fee limit
94 *
95 * @param _offers - the array of fully populated Offer structs with offer id set to 0x0 and voided set to false
96 * @param _offerDates - the array of fully populated offer dates structs
97 * @param _offerDurations - the array of fully populated offer durations structs
98 * @param _disputeResolverIds - the array of ids of chosen dispute resolvers (can be 0)
99 * @param _agentIds - the array of ids of agents
100 */
101function createOfferBatch(
102 Offer[] calldata _offers,
103 OfferDates[] calldata _offerDates,
104 OfferDurations[] calldata _offerDurations,
105 uint256[] calldata _disputeResolverIds,
106 uint256[] calldata _agentIds
107) external override offersNotPaused {

Recommendation:

We advise the nonReentrant modifier to properly be applied to the function as it interacts with unknown tokens which may cause the offer creation workflow to be hijacked mid-creation.

Alleviation (44009967e4f68092941d841e9e0f5dd2bb31bf0b):

The nonReentrant modifier has been properly introduced to the createOfferBatch function as advised.