Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

In PreMarkets.sol listOffer function changes originOfferInfo only in-memory, but the result is supposed to be stored in storage

pandasec

Summary

In PreMarkets.sol listOffer function changes originOfferInfo only in-memory, but the result is supposed to be stored in storage

Vulnerability Details

In PreMarkets.sol listOffer function changes originOfferInfo only in-memory, but the result is supposed to be stored in storage - https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L342

if (makerInfo.offerSettleType == OfferSettleType.Turbo) {
address originOffer = makerInfo.originOffer;
OfferInfo memory originOfferInfo = offerInfoMap[originOffer];
​
if (_collateralRate != originOfferInfo.collateralRate) {
revert InvalidCollateralRate();
}
originOfferInfo.abortOfferStatus = AbortOfferStatus.SubOfferListed;
}

Impact

As a result of this, the originOfferInfo abortOfferStatus will not be set to AbortOfferStatus.SubOfferListed. There is not enough documentation as to what this offer status does but the functions that check for an abortOfferStatus will not function correctly.

Tools Used

Manual review

Recommendations

Change the variable to storage:

OfferInfo memory originOfferInfo = offerInfoMap[originOffer];
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-listOffer-originIOfferInfo-storage-memory

Valid high severity, because the `abortOfferStatus` of the offer is not updated and persist through `storage` when listing an offer for turbo mode within the `offerInfoMap` mapping, it allows premature abortion given the `abortOfferStatus` defaults to `Initialized`, allowing the bypass of this [check](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L552-L557) here and allow complete refund of initial collateral + stealing of trade tax which can potentially be gamed for profits using multiple addresses

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.