Incorrect offerStatus check in DeliveryPlace::closeBidOffer causes inconsistency in closing Bid Offers
Summary
In the DeliveryPlace::closeBidOffer function, there is an inconsistency between the expected offer status and the actual status being checked.
Vulnerability Details
The function comment states that the "offer status must be Settling", but the code actually checks for the Virgin status. This mismatch could lead to unexpected behavior and potentially allow offers to be closed in an incorrect state.
This inconsistency could allow offers to be closed when they shouldn't be, or prevent offers from being closed when they should be.
Impact
This inconsistency allows offers to be closed in incorrect states, potentially causing financial losses or system inconsistencies.
However, other checks in the function, like the market place status check, mitigate the risk of exploitation.
Tools Used
Manual Review
Recommendations
Update the closeBidOffer function to check for the correct offer status. If Settling is indeed the correct status, modify the code as follows:
Lead Judging Commences
finding-PreMarkets-closeBidOffer-Virgin-Settling
Based on the current Tadle market system, the `Settling` status is never used (along with `Ongoing` and `Filled`), which is supposed to represent the state before settlement by original maker. While sementically, the `Virgin` status does not represent the correct phase to allow early closures before settlement, this issue does not have any current impact given technically the early closure of bid offers is still allowed. However, if we are basing it off of the correct status implementation (i.e. `Settling` phase appropriately updated when takers create offers), then the DoS will occur, essentially blocking any early closure of bids by subsequent makers, forcing them to follow through to final settlement. Unfortunately, none of these issues identify the correct pre-context mentioned above, but I believe medium severity is appropriate. Note for downgrade to low severity: Agree with above appeals and low severity, this is more of a status accounting error and does not have any impact, given the function of `closeBidOffer` is to withdraw the unused portion of sales proceeds. It can be executed as long as the TGE time has been reached, and it restricts the offer to be in a Virgin state. Since the statuses consistently do not utilize a switch from Vigin to Ongoing/Filled and the protocol can function appropriately even without the use of such statuses (presuming other bugs are fixed), the DoS impact will not occur.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.