Tadle

Summary

An error in the formula used to calculate depositAmount within the PreMarkets::abortBidTaker function leads to an incorrect recording of the depositAmount. This discrepancy can result in Bid Takers being refunded an incorrect amount of tokens, which differs from what they initially deposited.

Vulnerability Details

The vulnerability is found in the PreMarkets::abortBidTaker function, specifically in the calculation of the depositAmount. The current formula is incorrectly arranged, causing an inaccurate computation. Below is the problematic code:

Issue Breakdown:

• Incorrect Formula:

  • The current formula is:

    depositAmount = (stockInfo.points * preOfferInfo.points) / preOfferInfo.amount

  • This formula is incorrect because it does not properly calculate the proportional deposit amount based on the points and amount.

• Correct Formula:

  • The correct formula should be:

    depositAmount = (stockInfo.points * preOfferInfo.amount) / preOfferInfo.points

  • This corrects the order of operations, ensuring that the depositAmount is proportional to the points and amount as originally intended.

Impact in the Code:

• The incorrect formula leads to a situation where the Bid Taker is refunded an incorrect amount of tokens, which can differ significantly from their original deposit.

• This discrepancy is evident when compared to the correct formula used elsewhere in the code, specifically in the PreMarkets::createTaker function, which calculates the depositAmount correctly.

Impact

Due to the incorrect formula, the protocol miscalculates the depositAmount, resulting in incorrect refunds to Bid Takers. This can lead to financial losses or inconsistencies in the protocol's accounting, potentially undermining user trust and the protocol’s integrity.

Tools Used

• Manual analysis

Recommendations

The protocol should update the formula in the PreMarkets::abortBidTaker function to correctly calculate the depositAmount. The correct formula should be:

This adjustment will ensure that the depositAmount is accurately recorded and that Bid Takers are refunded the correct amount of tokens.