Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Same Offer Can Be Created Multiple Times Using the Same `CreateOfferParams`

silentwalker

Summary

The protocol allows the creation of the same offer multiple times using identical CreateOfferParams, leading to potential loss of user funds due to bypassed checks for existing offers.

Vulnerability Details

Title

Same Offer Can Be Created Multiple Times Using the Same CreateOfferParams

Summary

The protocol allows the creation of the same offer multiple times using identical CreateOfferParams, leading to potential loss of user funds due to bypassed checks for existing offers.

Vulnerability Details

When creating an offer, the maker address, offer address, and stock address are generated using the offerId. A value of 1 is added to the offerId previously used to generate the address, which is then used to update maker, offer, and stock information, as shown below:

offerId = offerId + 1;

The following updates occur in the respective mappings:

/// @dev update maker info
makerInfoMap[makerAddr] = MakerInfo({
offerSettleType: params.offerSettleType,
authority: _msgSender(),
marketPlace: params.marketPlace,
tokenAddress: params.tokenAddress,
originOffer: offerAddr,
platformFee: 0,
eachTradeTax: params.eachTradeTax
});
​
/// @dev update offer info
offerInfoMap[offerAddr] = OfferInfo({
id: offerId,
authority: _msgSender(),
maker: makerAddr,
offerStatus: OfferStatus.Virgin,
offerType: params.offerType,
points: params.points,
amount: params.amount,
collateralRate: params.collateralRate,
abortOfferStatus: AbortOfferStatus.Initialized,
usedPoints: 0,
tradeTax: 0,
settledPoints: 0,
settledPointTokenAmount: 0,
settledCollateralAmount: 0
});
​
/// @dev update stock info
stockInfoMap[stockAddr] = StockInfo({
id: offerId,
stockStatus: StockStatus.Initialized,
stockType: params.offerType == OfferType.Ask
? StockType.Bid
: StockType.Ask,
authority: _msgSender(),
maker: makerAddr,
preOffer: address(0x0),
offer: offerAddr,
points: params.points,
amount: params.amount
});

When creating another offer using the same CreateOfferParams, the checks to determine whether the maker, stock, or offer already exists will be bypassed because the makerAddr, offerAddr, and stockAddr stored in the mapping were generated using a different offerId.

Impact

The same offer can be created multiple times, leading to a potential loss of user funds.

Tools Used

Manual Review

Recommendation

Update the offerId before generating the addresses and storing them.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createOffer-offerId-increment-after

I believe this is valid low severity, although there is inconsistency here when using the correct `offerId` for assigning offerIds and generating the unique addresses as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L67-L69), this is purely an accounting error for offerIds. If we generate the offerId using current `offerId - 1`, the appropriate listing/taker orders can still be created against those offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.