Tadle

Summary

Because the abortBidTaker function calculates depositAmount incorrectly, the accounting for the token amount to be refunded to the corresponding stock's authority becomes incorrect. For instance, when the calculated depositAmount is incorrectly lower than what it should be, the token amount refunded to the corresponding stock's authority would be incorrectly lower than what he is entitled to.

Vulnerability Details

The following abortBidTaker function executes uint256 depositAmount = stockInfo.points.mulDiv(preOfferInfo.points, preOfferInfo.amount, Math.Rounding.Floor), which is equivalent to depositAmount = stockInfo.points * preOfferInfo.points / preOfferInfo.amount in mathematic expression. However, since such mathematic expression does not result in a portion of preOfferInfo.amount, the calculated depositAmount does not make sense and is incorrect. Because the OfferLibraries.getDepositAmount function call uses the incorrect depositAmount to calculate transferAmount, such transferAmount is also incorrect. When the tokenManager.addTokenBalance function is called with the incorrect transferAmount for TokenBalanceType.MakerRefund, the accounting for the token amount to be refunded to the corresponding stock's authority becomes incorrect as well.

https://github.com/Cyfrin/2024-08-tadle/blob/c249cdb68c37c47025cdc4c4782c8ee3f20a5b98/src/core/PreMarkets.sol#L645-L697

Impact

The token amount to be refunded to the corresponding stock's authority is incorrect when the abortBidTaker function is called. For example, when the calculated depositAmount is incorrectly lower than what it should be, the token amount refunded to the corresponding stock's authority would be incorrectly lower than what he is entitled to.

Tools Used

Manual Review

Recommended Mitigation

The calculation of depositAmount in the abortBidTaker function needs to be corrected in which the correct depositAmount would be a portion of preOfferInfo.amount.