Submission Details
Severity:
Taker's creator could take any amount of points from the offer.
Summary
Premarkets.sol#createTaker() has implemented a check opposite to the intended design.
Vulnerability Details
During the creation of the taker total points of an offer should be more than the taker & offer-used points combined which is also represented in the natspec:
function createTaker(address _offer, uint256 _points) external payable {
/**
* @dev offer must be virgin
* @dev points must be greater than 0
* @dev total points must be greater than used points plus _points
*/
if (_points == 0x0) {
revert Errors.AmountIsZero();
}
OfferInfo storage offerInfo = offerInfoMap[_offer];
MakerInfo storage makerInfo = makerInfoMap[offerInfo.maker];
if (offerInfo.offerStatus != OfferStatus.Virgin) {
revert InvalidOfferStatus();
}
if (offerInfo.points < _points + offerInfo.usedPoints) {//<------------- Issue
revert NotEnoughPoints(
offerInfo.points,
offerInfo.usedPoints,
_points
);
}
...
}
The check has been implemented opposite of the intended design due to which takers could be created with any amount of points that the caller of this function wants.
Impact
Takers could be created with any amount of points
Tools Used
Manual review
Recommendations
function createTaker(address _offer, uint256 _points) external payable {
/**
* @dev offer must be virgin
* @dev points must be greater than 0
* @dev total points must be greater than used points plus _points
*/
if (_points == 0x0) {
revert Errors.AmountIsZero();
}
OfferInfo storage offerInfo = offerInfoMap[_offer];
MakerInfo storage makerInfo = makerInfoMap[offerInfo.maker];
if (offerInfo.offerStatus != OfferStatus.Virgin) {
revert InvalidOfferStatus();
}
- if (offerInfo.points < _points + offerInfo.usedPoints)
+ if (offerInfo.points > _points + offerInfo.usedPoints)
{
revert NotEnoughPoints(
offerInfo.points,
offerInfo.usedPoints,
_points
);
}
...
}
Prize pool breakdown
Total prize
27,750 USDC
nSLOC
1,22923 USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.