Tadle

Summary

In PreMarkert::abortBidTaker using openZeppelin's mulDiv function in math.sol to calculate the depositAmount that is used to get the transferAmount, the params are not arranged properly and the amount calculated is not accurate.

Vulnerability Details

When calculating, the depositAmount used to calculate the transferAmount in abortBidTaker, the stockInfo.points is multiplied by the preOfferInfo.points instead of the preOfferInfo.amount and then divided by preOfferInfo.amount instead of preOfferInfo.points.

This arises due to the wrong arrangement of parameters that are given to openZeppelin's mulDiv function which will first multiply the stockInfo.points and preOfferInfo.points, then divide them by preOfferInfo.amount. This will most likely lead to a zero amount or a very low deposit amount.

PreMarkert.sol Line 671

Proof of Concept

Here is a scenario where:
stockInfo.points = 500
preOfferInfo.points = 1000
preOfferInfo.amount = 100_000e18

When you workout the above scenario: (500 * 1000)/100_000e18 = 0
The depositAmount will be zero, making the transferAmount also to be zero.

Impact

User will not be able get back all their amount that they deposited, hence loss of funds.

Tools Used

Manual Review

Recommendation

Cosider changing the parameters given to openZeppelin's mulDiv function such that stockInfo.points is multiplied by preOfferInfo.amount and divided by preOfferInfo.points to get the correct calculation.