Tadle

Summary

createOffer and listOffer functions allow a mismatch between the required collateral (transferAmount) and the actual msg.value sent by the user, potentially leading to insufficient or excessive collateral being posted.

Vulnerability Details

The createOffer function and the listOffer function, inside PreMarkets.sol calculates the transferAmount but doesn't check if it matches the msg.value sent by the user. This oversight could result in incorrect collateral being transferred, which may destabilize the offer.

Additionally, there's no check for a maximum collateralRate, potentially allowing excessively high collateral requirements.

Impact

This can lead to collateral mismatches, resulting in insufficient or excessive collateral being posted, and unexpected behavior due to the lack of a maximum collateralRate check.

Tools Used

Imagination

Recommendations

The contract should include a check in both functions to ensure msg.value matches transferAmount and enforce a reasonable limit on collateralRate to prevent these issues.