Tadle

Summary

The attacker can reduce the refund obtained by the executor of abortAskOffer.

abortAskOffer is missing slippage control parameters, attackers can employ a sandwich-attack-like approach, executing createTaker before the user's abortAskOffer and abortBidTaker after, thereby causing the caller of abortAskOffer to incur asset losses at low cost.

Vulnerability Details

In abortAskOffer, If points have been sold , the fund that the seller can recover will be reduced.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L595-L621

In abortBidTaker, the buyer can receive a refund from the collateral based on the purchased amount.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L671-L683

abortBidTaker can only be executed after abortAskOffer.

This will lead to the following scenario:

1. Assuming the collateralRate is 100%.

2. Alice, as the seller, deposits 100 tokens to sell 100 points.

3. No one buys them, and Alice wants to settle this offer early, so she executes abortAskOffer.

4. Bob monitors Alice's request and then front run createTaker to buy Alice's 100 points in this block before Alice's abortAskOffer.

5. Alice's abortAskOffer executes, and since all points are sold, Alice will not get a refund.

6. Bob immediately executes abortBidTaker to get a refund after abortAskOffer.

7. In the end, Bob uses a kind of sandwich attack to make Alice lose her assets.

Impact

The attacker can reduce the refund obtained by the executor of abortAskOffer.

Tools Used

vscode

Recommendations

Add expectedRefundAmount to abortAskOffer, If the expected quantity is not met, it will revert. In this way, if abortAskOffer reverts, the attacker will not be able to execute abortBidTaker to recover the attack cost.