Tadle

Summary

abortAskOffer(address, address) on PreMarkets contract is calculating makerRefundAmount incorrectly if the offer was canceled beforehand which leads to a lost of user funds.

Vulnerability Details

If the user canceled the offer before aborting it - he should not receive the entire amount in question because he was refunded the unsold amount during cancelation:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L441C1-L455C15

The cancellation of the offer and its remaining amount to recover for the maker is checked on an if condition:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L584C1-L593C10

If an offer was canceled - the remainingAmount variable should reflect the amount that was not sold yet.

Unfortunately, the rest of the calculations - from line 595 to 613 do not properly reflect the remaining amount that is to be refunded. It looks like the calculations were made without consideration if the offer was canceled beforehand.

Concluding from the code, we determine that the transferAmount should have included the entire amount into its calculation and not just the remainingAmount.

Because of this - canceled offers can not be properly refunded.

Impact

Funds are not properly accounted for and lost for the user - he can not recover them by aborting the ask offer.

We conclude this to be of HIGH severity.

Tools Used

Manual review

Recommendations

Implement a proper mechanism for recovering funds from a canceled ask offer.