Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Trade tax and settled collateral amount are not updated in offer struct

robertodf99

Summary

The OfferInfo struct contains various elements, including two fields specifically intended to store the trade tax charged and the amount of collateral settled:

struct OfferInfo {
uint256 id;
address authority;
address maker;
OfferStatus offerStatus;
OfferType offerType;
AbortOfferStatus abortOfferStatus;
uint256 points;
uint256 amount;
uint256 collateralRate;
uint256 usedPoints;
@> uint256 tradeTax;
uint256 settledPoints;
uint256 settledPointTokenAmount;
@> uint256 settledCollateralAmount;
}

However, neither of these two fields is updated at any time.

Vulnerability Details

When users query information using the PreMarkets::getOfferInfo getter function, they receive incorrect data. This discrepancy can impact frontend functionalities.

Impact

See PoC below:

function test_offer_params_not_updated() public {
vm.startPrank(user);
​
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
vm.stopPrank();
​
vm.startPrank(user1);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
address stockAddr = GenerateAddress.generateStockAddress(0);
address offerAddr = GenerateAddress.generateOfferAddress(0);
​
preMarktes.createTaker(offerAddr, 500);
vm.stopPrank();
​
vm.prank(user1);
systemConfig.updateMarket(
"Backpack",
address(mockPointToken),
0.01 * 1e18,
block.timestamp - 1,
3600
);
​
vm.startPrank(user);
mockPointToken.approve(address(tokenManager), type(uint256).max);
deliveryPlace.settleAskMaker(offerAddr, 500);
​
OfferInfo memory offerInfo = preMarktes.getOfferInfo(offerAddr);
assertEq(offerInfo.tradeTax, 0);
assertEq(offerInfo.settledCollateralAmount, 0);
}

Tools Used

Manual review.

Recommendations

Ensure that the trade tax is updated when the taker accepts the offer. Similarly, update the settled collateral when it is returned, such as when the offer is either closed or settled.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createTaker-offerInfo-tradetax-settledCollateralAmount-not-updated

Borderline low/informational, tradeTax is posted by the original maker when creating an offer within the `makerInfo` mapping as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L112C13-L112C25). and is simply a placeholder for the offerInfo mapping. Given it can impact details of offer regarding the tradeTax, low severity seems appropriate. Similar reasonings apply for settledCollateralAmount.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.