Tadle

Summary

A vulnerability has been identified in the listOffer function where the originOfferInfo struct is defined as a memory variable instead of storage. This issue leads to the incorrect handling of the abortOfferStatus attribute, potentially resulting in inconsistent contract state and unexpected behavior.

Vulnerability Details

In the listOffer function, the originOfferInfo struct is intended to reference an existing offer's state in storage. However, it is incorrectly defined as a memory variable, which creates a temporary copy of the data rather than pointing to the original data in storage. As a result, any modifications made to abortOfferStatus do not persist beyond the function execution.

The relevant code snippet is:

Here, the abortOfferStatus attribute is updated in memory but not in storage, leading to the change being discarded when the function execution ends.

Impact

The improper use of memory instead of storage results in the abortOfferStatus attribute not being updated correctly. This can cause the contract to function incorrectly, with offers that should be marked as aborted still being treated as active. It could lead to potential exploits or unintended consequences where aborted offers are mistakenly processed.

Tools Used

Manual Code Review

Recommendations

To fix this vulnerability, the originOfferInfo variable should be defined as a storage type, ensuring that any changes to the abortOfferStatus attribute are correctly persisted to the blockchain's storage.

The corrected code snippet would look like this:

This change ensures that the abortOfferStatus is properly updated in the contract's storage, preventing any inconsistencies or potential vulnerabilities.