Tadle

Summary

Because the system does not deduct balances from the mapping of the token balances users can use closeOffer and relistOffer to keep on stacking token to their MakerRefund balance

Vulnerability Details

This mapping is important as, it tracks the amount for every token balance type, but the critical part is that when a withdrawal happens it does not actually reset it to zero as shown in the withdraw function

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L137C5-L189C6

This allows user to exploit this critically by making repeated calls to closeOffers and relistOffers as described below

closeOffer

calculates the refund amount and adds it to tokens balance

relistOffer

This allows you to deposit again to relist the offer, but if you withdrew when the offer was closed, and you use that same amount to deposit again, because the tokenBalancetype does not reduce it keeps stacking up for example below

1- user close makerRefund =1000
2- withdraw makerRefund = 1000 stlll --due to bug should be zer
3- relist makerRefund = 1000
4- close again makerRefund = 2000 instead of 1000
5- withdraws makerRefund = 2000
6- relist makerRefund = 2000
7- closes again makerRefund =3000

All done with the initial 1000 amount

Impact

Accounting process are important as if they are implemented incorrectly, this will cause the protocol to be insolvent

Tools Used

manual review

Recommendations

Deducting the amount from the tokenBalancetype will prevent this issue