Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Collateral fee during settling of ask taker is calculated incorrectly

maushishreal

Summary

DeliveryPlace.sol#settleAskTaker passes the wrong boolean value in the calculation of the collateral fee.

Vulnerability Details

DeliveryPlace.sol#settleAskTaker calculates collateralFee by internally calling getDepositAmount which takes boolean value to check if the caller is the offer authority or not which in this case its true.

function settleAskTaker(address _stock, uint256 _settledPoints) external {
...
uint256 collateralFee = OfferLibraries.getDepositAmount(
offerInfo.offerType,
offerInfo.collateralRate,
stockInfo.amount,
false, //<--------------ISSUE
Math.Rounding.Floor
);
​
if (_settledPoints == stockInfo.points) {
tokenManager.addTokenBalance(
TokenBalanceType.RemainingCash,
_msgSender(),
makerInfo.tokenAddress,
collateralFee
);
} else {
tokenManager.addTokenBalance(
TokenBalanceType.MakerRefund,
offerInfo.authority,
makerInfo.tokenAddress,
collateralFee
);
}

Due to passing false as a boolean and the offerType being ask, the return value of the collateral fee will be stockInfo.amount which is not the intended result.

Impact

  • Wrong updates in token balance will be pushed leading to more incorrect calculation

  • wrong event emission values.

Tools Used

Manual review

Recommendations

function settleAskTaker(address _stock, uint256 _settledPoints) external {
...
uint256 collateralFee = OfferLibraries.getDepositAmount(
offerInfo.offerType,
offerInfo.collateralRate,
stockInfo.amount,
- false,
+ true,
Math.Rounding.Floor
);
​
...
}
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-PreMarkets-settleAskTaker-isMaker-false

Invalid, when a taker creates a offer type `StockType.Ask` for a `OfferType.Bid` in protected mode via `createTaker()`, when the `_depositTokenWhenCreateTaker` is invoked, it computes the collateral for the taker to deposit with `(_offerType == OfferType.Bid && !_isMaker)`, in which the collateral will compute based on collateral ratio set by original offer maker as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/libraries/OfferLibraries.sol#L44-L51). When `settleAskTaker` is invoked, the same condition of `(_offerType == OfferType.Bid && !_isMaker)` is used, so the same computation seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/libraries/OfferLibraries.sol#L44-L51) is invoked, which means collateral refund is correct.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.