There is an invalid calculation of the totalDepositAmount
in the PreMarkets.abortAskOffer()
function that results in an overinflated Maker refund when the collateralRatio > 100%
. As a result, the Maker receives a larger refund than expected, while the Taker receives the compensation as expected. This discrepancy leads to a loss of funds for the protocol and other users, as an attacker exploiting this issue can extract all the funds from the system.
In the PreMarkets.abortAskOffer()
function, the calculation for totalDepositAmount
is as follows:
The issue here is that totalDepositAmount
should also be calculated from the Maker's perspective and account for the collateral ratio, similar to the calculations for transferAmount
done earlier.
If totalDepositAmount
is not counted as a Maker deposit, the following line will result in an excessively large refund for the Maker:
An attacker can exploit this issue to extract all funds from the system. Here is how:
The attacker, as a Maker, creates an Ask offer with a 100000% collateral ratio, with 50 points for 50 USDC, and deposits 50000 USDC as collateral.
The attacker, as a Taker, takes this Ask offer and buys 25 points for 25 USDC.
The Ask offer is aborted, and the Maker receives a 49975 USDC refund. The offer is marked as Settled.
The attacker, as a Taker, calls DeliveryPlace.closeBidTaker()
and receives 25000 USDC as compensation for not receiving the Points tokens.
As a result, the attacker can extract 24975 USDC from the protocol. This exploit can be achieved within a single transaction, and a flash loan can be used, meaning the attacker does not need to possess 50k USDC as collateral initially.
Loss of funds.
Manual review.
Use true
for the _isMaker
parameter in the OfferLibraries.getDepositAmount()
function to ensure accurate calculations of totalDepositAmount
.
Valid high severity, the `totalDepositAmount` of collateral computed from the amount of point used (posted to transact) should use the same isMaker flag as when computing the original collateral deposited by maker, if not, the amount available for withdrawal during abortion will be overestimated
Valid high, for unsettled ask offers by the original maker, the initial remaining maker collateral is already refunded as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L624-L629)
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.