abortBidTaker() function calculates stockOwner refund amount wrong
Summary
abortBidTaker() function calculates stockOwner refund amount wrong, inflating the deposit amount by a lot if preOfferInfo.points is a large number. Lets see some examples:
Vulnerability Details
The formula is this:
1. If user bought 50 points from 100 points that costs 100 amount
(50 * 100) / 100 = 50
It seems that the result is correct
2. User bought 50 pounts from 1000 points that costs 100 amount
(50 * 1000) / 100 = 500
This is way over the amount, and it could be used by the user that calls this function on his stock to gain advantage of such trades.
What if we change the formula to look like this:
If we have the 1st example, it is the same again.
2nd example:
(50*100) / 1000 = 5 which is actual amount of stocks bought.
Impact
High
Tools Used
Manual Review
Recommendations
The formula should look like this
Lead Judging Commences
finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points
Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.