Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Inconsistent deposit amount calculations, leads to loss of funds during abortBidTaker

inzinko

Summary

When calculating how much amount to deposit for the number of points being bought, the createTakerfunction actually gets the ratio of amount to points to get how much each point is worth, to know the amount for the taker to deposit, but in the abort bidTaker the same implemenation to get the amount to remove is not done, which return a wrong deposit amount back for the user to withdraw

Vulnerability Details

Simple explanation to exhibit the issue

/// @dev Transfer token from user to capital pool as collateral
uint256 depositAmount = _points.mulDiv(
offerInfo.amount,
offerInfo.points,
Math.Rounding.Ceil
);

This is the correct calculation in createTaker which if we do the calculations here,
points -1000 amount-10000, _points-600
600* 10000/1000 = 6000 -- The user will deposit 6000 amount to get 600 points

Now lets see the same implementation in abortBidTaker

uint256 depositAmount = stockInfo.points.mulDiv(
preOfferInfo.points,
preOfferInfo.amount,
Math.Rounding.Floor
);

Following this we see that the calculation would be

600 * 1000/10000 = 60

60 as amount is used to get the 72 total amount from the calculation below with the collateral

uint256 transferAmount = OfferLibraries.getDepositAmount(
preOfferInfo.offerType,
preOfferInfo.collateralRate,
depositAmount,
false,
Math.Rounding.Floor
);

Which will be added to the MakerRefund and the stockInfoStatus will be set to finshed

Impact

Since the function is meant to help takers retrive their collateral if they are aborting, returning a wrong amount will lead to loss of fund since the stock status is set to finished at the end of the calculations

Tools Used

Manual Review

Recommendations

This formula should be used

uint256 depositAmount = _points.mulDiv(
offerInfo.amount,
offerInfo.points,
Math.Rounding.Ceil
);
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points

Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.