Tadle

Summary

In the abortBidTaker function, the depositAmount is incorrectly calculated. This leads to an incorrect amount being added to the users balance, which could lead to loss of funds.

Vulnerability Details

In the abortBidTaker() function, the depositAmount is incorrectly calculated:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L671-L675

Here it is calculate as (stockInfo.points x preOfferInfo.points) / preOfferInfo.amount.

A malicious attacker could use this incorrect calculation to his advantage and get more amount than he deserves.
One such scenario is:

• Assume Bob creates an ask offer of 100points for 2USDC, and giving 2USDC collateral.

• Alice takes this offer (createTaker), 50 points, and paying 1USDC. (increasing BOB's balance by 1USDC + tax + platformfee)

• Bob aborts his ask offer (abortAskOffer) and is refunded 1 USDC.

• Alice now aborts her stock (generated in createTakerfunction), by callign the abortBidTaker() function.

• Here the depositAmount is wrongly calculated as (50x100)/2 = 2500

• Alice is thus refunded 2500USDC instead of the 1USDC she should have been.

Note that for the sake of simplicity small numbers have been used. But in a real world scenario, if alice and bob work together, they can make the discrepancy very large.

Impact

In the worst case scenario malicious attacker can completely drain the funds of the contract using the method shown above, and in the best case users funds are calculated incorrectly.

Tools Used

Manual Review

Recommendations

Change the calculation of depositAmount (line 671) as follows: