Tadle

Tadle
DeFiFoundry
27,750 USDC
View results
Submission Details
Severity: low
Valid

Incorrect recording of offerId in createOffer() in PreMarkets.sol

Summary

Incorrect recording of offerId in offerInfoMap and stockInmap since the keys of the mappings are generated from the offerId , however the recorded offerId in mappings are plused one.

Vulnerability Details

offerInfoMap and stockInfoMap all generate addresses as the keys of the map. The mappings keys are generated from hash of offerId, yet the offerId is immediately plus before the mapping data writing. Thus will cause the mismatch of the recorded offerId and the mapping keys(originally from offerId).

Tools Used

manual

Recommendations

Relocate the offerId increament statement after the mapping data writing.

#89 - offerId = offerId + 1
#147 + offerId = offerId + 1
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createOffer-offerId-increment-after

I believe this is valid low severity, although there is inconsistency here when using the correct `offerId` for assigning offerIds and generating the unique addresses as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L67-L69), this is purely an accounting error for offerIds. If we generate the offerId using current `offerId - 1`, the appropriate listing/taker orders can still be created against those offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.