Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Calculation

_frolic

Summary

The calculation for the depositAmount in the PreMarktes::abortBidTaker is largely incorrect.

Vulnerability Details

The PreMarktes::abortBidTaker function refunds the taker's tokens after an offer has been aborted, it calculates the amount to refund the taker by (multiplying stockInfo.points by PreOfferInfo.points and dividing by PreOfferInfo.amounts) which is very incorrect.

Found in https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L671

uint256 depositAmount = stockInfo.points.mulDiv(
preOfferInfo.points,
preOfferInfo.amount,
Math.Rounding.Floor
);

Impact

Scenario:

  • User1 creates an offer with amount = 0.1e18, points = 10000, collateral = 150% token = USDC/Any supported

  • User2 matches the order by calling createTaker on user1's offer with points = 3000 and pays 0.3e17 (excluding fees)

  • User1 aborts his offer by calling abortAskOffer

  • User2 calls abortBidTaker to get his refund but the amount refunded = 0.3e-9 approximately 0

This results in the taker's refund being very minimal if not zero.

Tools Used

Manual Analysis

Recommendations

Change the calculation for the depositAmount in the PreMarktes::abortBidTaker function.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points

Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.