Tadle

Summary

• The PreMarkets::listOffer is expected to update the abortOfferStatus to SubOfferListed for the Maker, so that they cannot abort the offer as someone is relisting the offer via the stocks.

• The OfferInfo of the origin offer of Maker is loaded in a variable which is initialized as memory, as a result of which any updations made to it will be temporary not permanent, thus this allows the Maker to abort the offer even if someone has relisted.

Vulnerability Details

• The vulnerability is present in the listOffer where it assigns the abortOfferStatus to a memory variable which will not be permanent as a result of which after the txn finishes the offer's abort status will remain unchanged, which was expected to be changed to SubOfferListed in the Turbo Mode.

• The updating of abortOfferStatus to SubOfferListed plays a very crucial role to prevent the Maker from aborting their offer in case offers are relisted by the takers.

• This gives the Maker the unfair access to abort an offer when the offer is relisted by any taker, and cause the violation of the invariant to not allow any abortion of offer in case their is relisting of offer.

Impact

• The Maker can abort the offer even if their are relisting in turbo mode.

• As in turbo mode, the relisters don't stake any collateral, as a result of which the takers who buys from the relisted offer will end up loosing their amount to the relisters as they won't be getting any compensation, as all compensation would be given to initial relisters.

Tools Used

Manual Review

Recommendations

Make the originOfferInfo variable as storage.