Summary
The code comments state require offer points to not be utilized fully .
It requires that the points the user wants to create a taker for + the used points , should be less than total offer points
However the code incorrectly implements that.
Vulnerability Details
The code comments in createTaker states
* @dev total points must be greater than used points plus _points
However the current implementation is following
if (offerInfo.points < _points + offerInfo.usedPoints) {
revert NotEnoughPoints(
offerInfo.points,
offerInfo.usedPoints,
_points
);
}
It allows the case where @dev total points are equal to used points plus _points
which conflicts above requirment
Proof of Concept
function test_create_exact_points_taker() public {
vm.startPrank(user);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
address offerAddr = GenerateAddress.generateOfferAddress(0);
preMarktes.createTaker(offerAddr, 1000);
}
PoC Output
[PASS] test_create_exact_points_taker() (gas: 820236)
Traces:
[820236] PreMarketsTest::test_create_exact_points_taker()
├─ [0] VM::startPrank(0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf)
│ └─ ← [Return]
├─ [525720] UpgradeableProxy::createOffer(CreateOfferParams({ marketPlace: 0xE6b1c25C9BAC2B628d6E2d231F9B53b92172fC2D, tokenAddress: 0xF62849F9A0B5Bf2913b396098F7c7019b51A820a, points: 1000, amount: 10000000000000000 [1e16], collateralRate: 12000 [1.2e4], eachTradeTax: 300, offerType: 0, offerSettleType: 1 }))
│ ├─ [520669] PreMarktes::createOffer(CreateOfferParams({ marketPlace: 0xE6b1c25C9BAC2B628d6E2d231F9B53b92172fC2D, tokenAddress: 0xF62849F9A0B5Bf2913b396098F7c7019b51A820a, points: 1000, amount: 10000000000000000 [1e16], collateralRate: 12000 [1.2e4], eachTradeTax: 300, offerType: 0, offerSettleType: 1 })) [delegatecall]
Impact
Takers with less points can be created than intended
Incorrect assumption about the code logic can put current and future developments and integrations at risk of failure
Tools Used
Manual Review , Foundry
Recommendations
Add equality check in the condition too
if (offerInfo.points <= _points + offerInfo.usedPoints) {
revert NotEnoughPoints(
offerInfo.points,
offerInfo.usedPoints,
_points
);
}
