Tadle

Vulnerability Details:

The createOffer function within the PreMarkets contract performs limited input validation. While it ensures that params.points and params.amount are non-zero, it does not impose upper limits on these values, potentially permitting extremely large values to be submitted.

Impact:

Permitting excessively large values could trigger unintended behavior, such as overflows in subsequent calculations, excessive gas consumption, or even destabilization of the system’s economic model.

Proof of Concept:

The following demonstrates how this issue might be exploited:
Link to code

Tools Used

Recommendations:

1. Add upper bounds validation for params.points and params.amount:

1. Conduct reasonability checks based on the intended use of the contract to ensure inputs fall within practical ranges.

2. Extend validation to other parameters within the CreateOfferParams struct to confirm they are within acceptable limits.