Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect formula used in `PreMarkets::abortBidTaker` to calculate the deposit amount resulting in incorrect allocatation of refund token amount to takers.

shikhar229169

Summary

  • The abortBidTaker allows the takers to get compensation in case the offer is cancelled, and allocate the exact amount of token to the taker via TokenManager.

  • It calculates the amount the taker deposited which was sent to the offer's authority and the same will be allocated to the taker as compensation.

  • But the formula used to calculate the depositAmount in PreMarkets::abortBidTaker, and will lead to incorrect token amount allocated leading to lost accounting in CapitalPool and TokenManager.

Vulnerability Details

The vulnerability is present in the PreMarkets::abortBidTaker function at line 671, where it incorrectly calculates the depositAmount as follows:

uint256 depositAmount = stockInfo.points.mulDiv(
preOfferInfo.points,
preOfferInfo.amount,
Math.Rounding.Floor
);

Here, the stockInfo.points represent the token that they taker is buying, preOfferInfo.points represents the total points put as offer by maker and preOfferInfo.amount represents the total amount of token set by maker to exchange the whole points.

And it incorrectly calculate it as:

(stockInfo.points / preOfferInfo.amount) * preOfferInfo.points

But correct calculation for the amount the taker deposited will be:

(stockInfo.points / preOfferInfo.points) * preOfferInfo.amount

Impact

Incorrect refund amount will be allocated to the taker in the mapping of TokenManager, and it will lead to incorrect accounting of token in CapitalPool and TokenManager.

Tools Used

Manual Review

Recommendations

Correct the calculation as:

​
uint256 depositAmount = stockInfo.points.mulDiv(
preOfferInfo.amount,
preOfferInfo.points,
Math.Rounding.Floor
);
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points

Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.