M-01 MitigationConfirmed

[code423n4]

Lines of code

Vulnerability details

This issue is mitigated.

Explanation of found problem

When RebalancingManager decides to sell some assets, then RevenueTrader can create Dutch trade auction. It starts with high price and then decreases it during the time. Once the price is good for someone, then he can bid and pay for the purchased assets. Rtoken system would benefit with higher bids. DutchTrade.bid function can be called at any time and it will then call origin.settleTrade function, which will call RevenueTrader.settleTrade, which then should call BackingManager.settleTrade. Both of this functions have notTradingPausedOrFrozen modifier, which will not allow to bid, when trading is paused. Because of that, RToken system will not receive the best price and someone can buy assets really cheap, when trading will be unpaused.

How it was fixed

As it was proposed by warden, reserve team have removed notTradingPausedOrFrozen modifier from RevenueTrader.settleTrade and BackingManager.settleTrade function, which means that even when trading is paused, users can bid and provide good price for assets.

[c4-judge]

0xean marked the issue as satisfactory

[c4-judge]

0xean marked the issue as confirmed for report