Submitted by 0x52, also found by datapunk, kenzo, kirk-baird, and pashov
Fund loss from marketplace.
sellPrincipalToken, buyPrincipalToken, sellUnderlying, buyUnderlying are all unpermissioned and use marketplace funds to complete the action but send the resulting tokens to msg.sender. This means that any address can call these functions and steal the resulting funds.
All functions should use safetransfer to get funds from msg.sender not from marketplace.
JTraversa (Illuminate) confirmed, but disagreed with severity and commented:
gzeoneth (judge) decreased severity to Medium and commented:
