Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Wrong OfferId stored in `offerInfoMap` and the `stockInfoMap` when creating offer.

joshuajee

Vulnerability Details

When creating a premarket offer the offerIdused in generating the offer makerAddr, offerAddrand stockAddris not the same one used in saving the offerInfoMap and the stockInfoMap.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L66

address makerAddr = GenerateAddress.generateMakerAddress(offerId);
address offerAddr = GenerateAddress.generateOfferAddress(offerId);
address stockAddr = GenerateAddress.generateStockAddress(offerId);

This is because the offerId is increased after the addresses have been generated.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L83

offerId = offerId + 1;

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L117

offerInfoMap[offerAddr] = OfferInfo({
@-> id: offerId,

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L135

stockInfoMap[stockAddr] = StockInfo({
@-> id: offerId,

Impact

Unexpected behavior

Tools Used

Manual Analysis

Recommendations

Increase the offerId after offerInfoMap and stockInfoMap not before.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createOffer-offerId-increment-after

I believe this is valid low severity, although there is inconsistency here when using the correct `offerId` for assigning offerIds and generating the unique addresses as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L67-L69), this is purely an accounting error for offerIds. If we generate the offerId using current `offerId - 1`, the appropriate listing/taker orders can still be created against those offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.