Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

CreateOffer allows eachTradeTax to be 100% ( 10000 bp ) violating code assumptions

0xreadyplayer1

Summary

The code comments in definition of Premarket.sol#CreateOffer states that

eachTradeTax must be less than 100%, decimal scaler is 10000

, however , the code only reverts if eachTradeTax is greater than 10_000

, leaving room for erroneous offers creation at the exact Trade tax of 10_000 or 100% that will affect future integrations and development due developer's assumptions being wrong.

Vulnerability Details

Here are the code blocks that might be helpful to visualize and understand the issue

`PreMarket.sol`

function createOffer(CreateOfferParams calldata params) external payable {
/**
* //snip
* @dev eachTradeTax must be less than 100%, decimal scaler is 10000
* //snip
*/
//snip
​
if (params.eachTradeTax > Constants.EACH_TRADE_TAX_DECIMAL_SCALER) {
revert InvalidEachTradeTaxRate();
}
​

Proof of Concept

// forge test --mt test_create_offer_for_100_percent_eachTradeTax -vvvv
function test_create_offer_for_100_percent_eachTradeTax() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12_000,
10_000,
OfferType.Ask,
OfferSettleType.Turbo
)
);
}
​

PoC Output

Ran 1 test for test/PreMarkets.t.sol:PreMarketsTest
[PASS] test_create_offer_for_100_percent_eachTradeTax() (gas: 540682)
Traces:
[540682] PreMarketsTest::test_create_offer_for_100_percent_eachTradeTax()
├─ [0] VM::startPrank(0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf)
│ └─ ← [Return]
├─ [525720] UpgradeableProxy::createOffer(CreateOfferParams({ marketPlace: 0xE6b1c25C9BAC2B628d6E2d231F9B53b92172fC2D, tokenAddress: 0xF62849F9A0B5Bf2913b396098F7c7019b51A820a, points: 1000, amount: 10000000000000000 [1e16], collateralRate: 12000 [1.2e4], eachTradeTax: 10000 [1e4], offerType:
0, offerSettleType: 1 }))

Impact

Offers with wrong each Trade Tax rate will be created , jeopardising Current and Future developments + Integrations with the protocol

Tools Used

Manual Review , Foundry

Recommendations

Ensure that in CreateOffer inside PreMarket , eachTradeTax needs to be less than 10_000

function createOffer(CreateOfferParams calldata params) external payable {\
//snip
​
if (params.eachTradeTax >= Constants.EACH_TRADE_TAX_DECIMAL_SCALER) {
revert InvalidEachTradeTaxRate();
}
​
//snip
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-off-by-one-Trade-TAX-100%

Similar to issue #1323, Despite this off-by-one error of the intended check, the difference between 99% and 100% is minimal, so I believe whether or not 100% is allowed has minimal impact. Ultimately, takers should not be realistically creating offer with such tradeTax

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.