Summary

insufficient validation of the ercAmount and price inputs when creating a bid. The contract does not adequately check if these inputs are manipulated in a way that allows eth to fall below the minimum bid value For more details show the vulnerability details

Vulnerability Details

The vulnerable part :

Here we have in this line the calculates the value of eth by multiplying ercAmount with price and then checks if it's less than a minimum bid value specified in LibAsset.minBidEth(asset) so If this condition is met, it reverts with the error Errors.OrderUnderMinimumSize().
The real vulnerability is that
An attacker can manipulate the ercAmount or price in such a way that the calculated eth value is less than the minimum bid value, and could trigger the revert condition
As an example of scenario shoe how can that be :

• let’s say that the minimum bid value is 10 ETH in wei in this part

• so manipulate ercAmount and price as this :
  *-Making eth < 10 ETH to trigger the revert
  *-And set a high price and a small ercAmount

• let's calculate eth:

• so eth is now 1000 in wei, which is less than the minimum bid value of 10 ETH (10,000,000,000,000,000,000 wei), the condition
  eth < LibAsset.minBidEth(asset) is met, and the contract will revert with the Errors.OrderUnderMinimumSize() error.

• as result This manipulation allows an attacker to disrupt the contract's expected behavior by creating a bid with a very high price and a very small ercAmount, and bypassing the minimum bid requirement and causing the contract to revert erroneously

Impact

An attacker can exploit this bug by setting an excessive high price and an extremely low ercAmount. This manipulation leads to eth being less than the minimum bid value, causing the contract to revert incorrectly.

Tools Used

Manual review and HARD HAT

Recommendations

This update can solve the problem in the that line that hase the vulnerability by adding require to ensure that ercAmount and price are both greater than zero and that the calculated eth value is equal to or greater than the minimum bid value