Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

CreateOffer allows eachTradeTax to be 100% ( 10000 bp ) violating code assumptions

0xreadyplayer1

Summary

The code comments in definition of Premarket.sol#CreateOffer states that

eachTradeTax must be less than 100%, decimal scaler is 10000

, however , the code only reverts if eachTradeTax is greater than 10_000

, leaving room for erroneous offers creation at the exact Trade tax of 10_000 or 100% that will affect future integrations and development due developer's assumptions being wrong.

Vulnerability Details

Here are the code blocks that might be helpful to visualize and understand the issue

`PreMarket.sol`

function createOffer(CreateOfferParams calldata params) external payable {
/**
* //snip
* @dev eachTradeTax must be less than 100%, decimal scaler is 10000
* //snip
*/
//snip
​
if (params.eachTradeTax > Constants.EACH_TRADE_TAX_DECIMAL_SCALER) {
revert InvalidEachTradeTaxRate();
}
​

Proof of Concept

// forge test --mt test_create_offer_for_100_percent_eachTradeTax -vvvv
function test_create_offer_for_100_percent_eachTradeTax() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12_000,
10_000,
OfferType.Ask,
OfferSettleType.Turbo
)
);
}
​

PoC Output

Ran 1 test for test/PreMarkets.t.sol:PreMarketsTest
[PASS] test_create_offer_for_100_percent_eachTradeTax() (gas: 540682)
Traces:
[540682] PreMarketsTest::test_create_offer_for_100_percent_eachTradeTax()
├─ [0] VM::startPrank(0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf)
│ └─ ← [Return]
├─ [525720] UpgradeableProxy::createOffer(CreateOfferParams({ marketPlace: 0xE6b1c25C9BAC2B628d6E2d231F9B53b92172fC2D, tokenAddress: 0xF62849F9A0B5Bf2913b396098F7c7019b51A820a, points: 1000, amount: 10000000000000000 [1e16], collateralRate: 12000 [1.2e4], eachTradeTax: 10000 [1e4], offerType:
0, offerSettleType: 1 }))

Impact

Offers with wrong each Trade Tax rate will be created , jeopardising Current and Future developments + Integrations with the protocol

Tools Used

Manual Review , Foundry

Recommendations

Ensure that in CreateOffer inside PreMarket , eachTradeTax needs to be less than 10_000

function createOffer(CreateOfferParams calldata params) external payable {\
//snip
​
if (params.eachTradeTax >= Constants.EACH_TRADE_TAX_DECIMAL_SCALER) {
revert InvalidEachTradeTaxRate();
}
​
//snip
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-off-by-one-Trade-TAX-100%

Similar to issue #1323, Despite this off-by-one error of the intended check, the difference between 99% and 100% is minimal, so I believe whether or not 100% is allowed has minimal impact. Ultimately, takers should not be realistically creating offer with such tradeTax

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!