Function abortAskOffer(address, address) calculates makerRefundAmount wrongly
Summary
abortAskOffer(address, address) on PreMarkets contract is calculating makerRefundAmount incorrectly if the offer was canceled beforehand which leads to a lost of user funds.
Vulnerability Details
If the user canceled the offer before aborting it - he should not receive the entire amount in question because he was refunded the unsold amount during cancelation:
The cancellation of the offer and its remaining amount to recover for the maker is checked on an if condition:
If an offer was canceled - the remainingAmount variable should reflect the amount that was not sold yet.
Unfortunately, the rest of the calculations - from line 595 to 613 do not properly reflect the remaining amount that is to be refunded. It looks like the calculations were made without consideration if the offer was canceled beforehand.
Concluding from the code, we determine that the transferAmount should have included the entire amount into its calculation and not just the remainingAmount.
Because of this - canceled offers can not be properly refunded.
Impact
Funds are not properly accounted for and lost for the user - he can not recover them by aborting the ask offer.
We conclude this to be of HIGH severity.
Tools Used
Manual review
Recommendations
Implement a proper mechanism for recovering funds from a canceled ask offer.
Lead Judging Commences
[invalid] finding-PreMarkets-abortAskOffer-Canceled exploit
Note, #148, #826, #1784 all stems from the fact that order statuses are not appropriately updated when a taker order is created against a maker offer. If the status is switched to `Ongoing/Filled` respectively, the virgin checks will fail appropriately and subsequently all this issues will be fixed. They could possibly be duplicates, so leaving open for appeal. This actually is closely related to issue #148. If a taker has created an Bid/Ask offer agains a original maker offer and the Status is adjusted to Ongoing/Filled accordingly, then the abortion/cancellations cannot occur so this issue cannot be exploited.
Appeal created
[invalid] finding-PreMarkets-abortAskOffer-Canceled exploit
Note, #148, #826, #1784 all stems from the fact that order statuses are not appropriately updated when a taker order is created against a maker offer. If the status is switched to `Ongoing/Filled` respectively, the virgin checks will fail appropriately and subsequently all this issues will be fixed. They could possibly be duplicates, so leaving open for appeal. This actually is closely related to issue #148. If a taker has created an Bid/Ask offer agains a original maker offer and the Status is adjusted to Ongoing/Filled accordingly, then the abortion/cancellations cannot occur so this issue cannot be exploited.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.