Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

offerid Incorrectly increased before being used to store parameters

inzinko

Summary

In the createOffer when an offer is made the current offerId is used to generate a hash used for storage, but the offerId used is increased before it can be used to store the offerId in the offerInfoMap

Vulnerability Details

address offerAddr = GenerateAddress.generateOfferAddress(offerId);

current offerId is used here

Then before the offerId is used to store the offerInfoMap, it is increased

offerId = offerId + 1;

Then offerInfoMap is updated with the wrong offerId

offerInfoMap[offerAddr] = OfferInfo({
id: offerId,
//@audit This OfferId used here is different from the offer id that was used to generate the offerAddr

Impact

id variable of the offerInfoMap is used to store important info about the id of the offer, wrong id may lead to wrong accounting

Tools Used

manual review

Recommendations

The offer Id should be increased at the end of the function to avoid discrepancy in the offerInfoMap

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createOffer-offerId-increment-after

I believe this is valid low severity, although there is inconsistency here when using the correct `offerId` for assigning offerIds and generating the unique addresses as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L67-L69), this is purely an accounting error for offerIds. If we generate the offerId using current `offerId - 1`, the appropriate listing/taker orders can still be created against those offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.