# Attacker can drain pool using executeBuyWithCredit with malicious marketplace payload

ParaSpace trusted maker price from LooksRare adapter but LooksRare charges taker price, letting attacker drain pool via mismatched order prices.

- Payout: Contest reward
- Severity: high
- Program: ParaSpace
- Credited: Trust
- Disclosed: 2023-04-27
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/498
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PoolMarketplace buyWithCredit / LooksRareAdapter.getAskOrderInfo
**Root cause:** LooksRareAdapter builds OrderInfo consideration from makerAsk.price only, ignoring takerBid.price, while LooksRareExchange actually transfers takerBid.price from the pool. Pool charges user the maker price but pays out the taker price.
**Steps:**
1. Attacker acts as both maker (owns 1 NFT) and taker.
2. Craft MakerOrder with price=10 DAI and a permissive execution strategy accepting any taker price.
3. Craft TakerOrder with price=1000 DAI, taker=pool address.
4. Call `buyWithCredit(LOOKSRARE_ID, encodedMatchAskWithTakerBid, {token: DAI, amount: 0}, 0)`.
5. Pool charges attacker only 10 DAI (maker price) but transfers 1000 DAI (taker price) to maker; attacker keeps NFT and 1000 DAI.
**How found:** Code review of LooksRareAdapter.getAskOrderInfo noting the TODO comment about minPercentageToAsk and that consideration uses makerAsk.price; cross-checked LooksRareExchange.matchAskWithTakerBid which charges takerBid.price, revealing the mismatch.
**Exploitation:** Attacker supplies zero-credit loan and a self-signed maker order plus taker order with inflated price. Pool validates consideration against makerAsk.price, collects only that from attacker, then delegatecalls LooksRare adapter which executes matchAskWithTakerBid; exchange transfers takerBid.price from pool to attacker-as-maker. Attacker walks away with pool funds plus the NFT/nToken.
**Escalation:** Zero credit amount bypasses asset whitelist via early return in _borrowTo/repay, so any ERC20 held by pool can be drained, not just supported collateral.
**Insight:** When a protocol wraps an external marketplace, compare which price field the wrapper validates versus which field the marketplace actually transfers; adapter TODOs around price handling are strong signals of a validation gap.