Tadle

Summary

The listOffer function incorrectly handles the storage update of the abortOfferStatus field for offers with the Turbo settlement type. Due to this mistake, offers that should not be abortable under the Turbo settlement type can still be canceled, leading to potential disruptions and exploitation in the system.

Vulnerability Details

In the listOffer function, when an offer's settlement type is Turbo, the function attempts to change the abortOfferStatus of the previous offer linked to the stock to AbortOfferStatus.SubOfferListed to prevent the offer from being aborted. However, this change is made to a memory copy of the offer information rather than updating the storage directly. The relevant code snippet is as follows:

Here, originOfferInfo is a memory variable, meaning any changes to abortOfferStatus are not persisted in storage. As a result, the original abortOfferStatus remains unchanged in storage, allowing offers that should be locked under the Turbo settlement type to be aborted.

Impact

This vulnerability allows offers with the Turbo settlement type to be canceled even after they have been listed. This contradicts the intended functionality, which should prevent such offers from being aborted. The issue could be exploited by malicious users to bypass the system's restrictions, leading to financial loss.

Tools Used

Manual Code Review

Recommendations

Use Storage Instead of Memory