Summary

In preMarket contract, the abortBidTaker function is designed to allow users to abort their bids and receive a refund of their deposit. However, a rounding issue in the getDepositAmount function leads to incorrect calculations of the required deposit, causing the system to give 0 deposit amount for refund. This results in users losing their deposited funds when attempting to abort their bids.

Vulnerability Details

• The abortBidTaker function is designed to allow users to abort their bids and receive a refund of their deposit.

• The depositAmount calculation in the abortBidTaker function makes a rounding issue making the deposit amount to be 0.

• Due to this rounding error, the system will not add any balance to the user's account and mark's the stock status as "finished,"leading to the user's inability to retrieve their deposited funds when calling abortBidTaker.

Impact

• Users are unable to recover their deposited funds due to the incorrect stock status triggered by the rounding issue.

• This results in a direct loss of funds for users who attempt to abort their bids under these conditions.

• The loss of users funds gets locked in the captialPool contract and can't be retrieved.

Proof of Concept

1. Bob is taker and trades with the preMarket contract.

2. Bob deposits buys 500 point tokens from alice(maker).

3. Bob lists his offer and waits for takers to accept.

4. Alice aborts her ask offer.

5. Bob tries to abort his bid taker to get back his deposited collateral as the settlement type is Protected.

6. Due to the rounding issue in the abortBidTaker function, Bob's deposit amount is calculated as 0.

7. Bob's funds are locked in the contract, and he is unable to retrieve his deposited amount.

Proof of Code

For testing the POC, run the following command:

Add the following code to the PreMarkets.t.sol contract:

Here is the output of the test:

Tools Used

• Manual Review

Recommendation

• Fix the Rounding Issue: Modify the depositAmount calculation to ensure that rounding errors are mitigated, possibly by using more precise calculations or by adjusting how deposits are calculated.