Exchange owner can consume all orders at arbitrary price

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-non-fungible/blob/323b7cbf607425dd81da96c0777c8b12e800305d/contracts/Exchange.sol#L543

Vulnerability details

Impact

The choice of policy to use for a transaction is determined by the listingTime. The listingTime can be supplied by the caller of execute()/bulkExecute() and can be arbitrary as along as it passes validation. And the policy of a given order is used to determine the transaction price when the order is matched with another order. The owner of the Exchange can change the policyManager, which determines which policies are whitelisted, at any time (or they can change which policies are whitelisted by the manager).

A malicious exchange operator could set a policy manager that allows arbitrary policies, then create a policy that allows payment at low prices, and finally supply a series of orders at low price, with this policy manager, and an early but valid listingTime set. This would allow purchasing offered tokens at low prices for example.

Proof of Concept

https://github.com/code-423n4/2022-11-non-fungible/blob/323b7cbf607425dd81da96c0777c8b12e800305d/contracts/Exchange.sol#L543
This is my first code4rena contest and unfortunately I did not have time to develop a poc.

Tools Used

Recommended Mitigation Steps

Increase validation of listingTime and add a timelock when changing the policy manager or changing which policies are whitelisted by the policy manager.

[c4-judge]

berndartmueller marked the issue as duplicate of #179

[c4-judge]

berndartmueller marked the issue as satisfactory