Tadle

Vulnerability Details:

The createTaker function within the PreMarkets contract is susceptible to precision loss when computing the transferAmount. This risk arises when there is a significant disparity between offerInfo.points and _points, leading to potential rounding inaccuracies.

Impact:

The loss of precision in these calculations can result in incorrect token transfer amounts. This could lead to users receiving fewer tokens than expected or the contract transferring more tokens than intended, causing potential financial discrepancies that could affect both users and the platform.

Proof of Concept:

Here’s an illustration of the issue in the createTaker function:

Link to code

In the above scenario, precision loss leads to the assertion failing, which demonstrates how the contract could transfer an incorrect amount.

Tools Used

Recommendations:

1. Increase Precision: Use a larger scale factor in intermediate calculations to mitigate precision loss and ensure accuracy in token transfers.

2. Implement Range Checks: Introduce checks to verify that the computed transferAmount is within an acceptable range to prevent significant discrepancies.

3. Safeguards for Disparities: Add mechanisms to handle situations where there is a substantial difference between _points and offerInfo.points, reducing the likelihood of precision-related errors.