Tadle

Summary

The PreMarket::settledAskOffer function in the smart contract lacks a critical zero address check for the _offer parameter. This oversight could potentially lead to unintended state changes or errors when settling non-existent offer entries.

Vulnerability Details

The PreMarket::settledAskOffer lacks validation to ensure that the provided _offer address is not the zero address (0x0). The function directly accesses the offerInfoMap using the provided address without any preliminary checks

This means that if a zero address is passed (either accidentally or maliciously), the function will still execute, potentially updating a non-existent offer entry or causing unexpected behavior.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L738-L749

Impact

The lack of a zero address check could lead to several issues:

1. Silent failures: Settling a non-existent offer (zero address) would not throw an error but would not have any real effect, potentially leading to misconceptions about the system state.

2. Potential for misuse: Malicious actors could exploit this to emit misleading events with a zero address offer.

3. Financial implications: If the system relies on this function for financial settlements, it could lead to incorrect accounting or loss of funds.

Tools Used

Manual Review

Recommendations

To address this vulnerability, implement a zero address check at the beginning of the function: