Tadle

Summary

The offerId global variable is used in both the CreateOffer and createTaker functions to generate unique addresses and assign IDs to offerInfoMap and stockInfoMap. However, due to the incorrect sequencing of operations, both an offer and its corresponding taker may end up sharing the same offerId, leading to duplicate IDs and potential conflicts within the system.

Vulnerability Details

The offerId variable is used to generate unique addresses for makerAddr, offerAddr, and stockAddr in the CreateOffer function. After generating these addresses, the offerId is incremented by 1 and stored as the ID in offerInfoMap[offerAddr].id and stockInfoMap[stockAddr].id.

However, in the createTaker function, the offerId is used before being incremented, which results in the same offerId being assigned to both the stock associated with the offer and the stock associated with the taker

This creates a scenario where the stockInfoMap for both the offer and the taker have the same ID, which can lead to conflicts and mismanagement within the protocol.

Impact

Same id to different stocks.

Manual Code Review

Tools Used

Recommendations

The offerId should be incremented before or after it is assigned in both the createOffer and createTaker functions.