Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Failure to Update stockStatus in DeliveryPlace::settleAskMaker Function

josh4324

Summary

The settleAskMaker function is responsible for finalizing the settlement of points tokens when a maker completes an offer. However, a significant issue has been identified: the stockStatus of the maker is not updated to "finished" after the settlement is completed. This oversight can lead to misleading information about the state of the points token, as the stockStatus is intended to track the state of the points token.

Vulnerability Details

After the maker successfully calls the settleAskMaker function to settle the points token, the stockStatus associated with the maker is not updated to "finished." The stockStatus is designed to indicate the current state of the maker's stock of points tokens, and failing to update it after settlement results in the system inaccurately reflecting the token's state.

POC

Run test in test/PreMarkets.t.sol

function test_stockFinish() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace, address(mockUSDCToken), 1000, 2000 * 1e18, 12000, 300, OfferType.Ask, OfferSettleType.Turbo
)
);
vm.stopPrank();
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
address stockAddr = GenerateAddress.generateStockAddress(0);
​
vm.startPrank(user3);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
preMarktes.createTaker(offerAddr, 1000);
vm.stopPrank();
​
vm.prank(user1);
systemConfig.updateMarket("Backpack", address(mockPointToken), 2 * 1e18, block.timestamp - 1, 3600);
​
vm.startPrank(user);
mockPointToken.approve(address(tokenManager), 2000 * 10 ** 18);
deliveryPlace.settleAskMaker(offerAddr, 1000);
vm.stopPrank();
​
vm.startPrank(user3);
address stock2Addr = GenerateAddress.generateStockAddress(1);
deliveryPlace.closeBidTaker(stock2Addr);
vm.stopPrank();
​
StockInfo memory sinfo = preMarktes.getStockInfo(stockAddr);
​
// This fails becuase stockStatus is not set to finished even though the settlement has been completed
assert(uint256(sinfo.stockStatus) == 2);
}

Impact

The inaccurate stockStatus can mislead users and system administrators, making it appear as though the maker still has points tokens available when, in fact, they have been settled. This discrepancy can lead to incorrect assumptions about the availability and movement of points tokens within the system.

Tools Used

Manual Review

Recommendations

Update stockStatusin settleAskMaker

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-Premarkets-stockStatus-update-missing

Valid low severity due to accounting error, although `stock` status is not update appropriately to `Finished`, there will be no exploit possible given relevant checks on the `offer` side.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.