Summary

In the PreMarkets::listOffer function, the originOfferInfo.abortOfferStatus is intended to be updated to AbortOfferStatus.SubOfferListed to prevent the offer from being aborted. However, because originOfferInfo is a memory copy rather than a storage reference, changes made to originOfferInfo do not persist in the offerInfoMap[originOffer]. This oversight leads to the abortOfferStatus update having no effect, allowing the check in abortAskOffer to be bypassed and resulting in the potential incorrect abortion of the ask offer.

Vulnerability Details

The vulnerability arises from the following code in the PreMarkets::listOffer function:

Here, the originOfferInfo variable is declared as a memory reference, which creates a copy of the data from offerInfoMap[originOffer] rather than a reference to the actual storage data. When originOfferInfo.abortOfferStatus is updated, the change is made to the in-memory copy, not the actual storage value in offerInfoMap.

As a result, the update to abortOfferStatus does not persist, and the abortOfferStatus remains unchanged in storage.

The unchanged abortOfferStatus is later checked in the abortAskOffer function:

Because the abortOfferStatus was not correctly updated, this check can be bypassed, allowing an offer to be incorrectly aborted, potentially causing disruptions or unexpected behavior in the market.

Impact

The impact of this vulnerability is significant as it undermines the logic designed to prevent the incorrect abortion of ask offers. By bypassing the abortOfferStatus check, offers that should not be aborted can be aborted, leading to potential financial loss or market instability.

Tools Used

Manual

Recommendations

To fix this issue, the originOfferInfo should be a storage reference rather than a memory copy. This ensures that any updates to originOfferInfo are directly reflected in the offerInfoMap storage.