Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Inconsistent offer type check in function closeBidOffer

kwakudr

Summary

The comment states that the offer type must be Bid, but the code checks if it's Ask and reverts if it is. This is the opposite of what's intended.

Vulnerability Details

The function's comment and its actual implementation are contradictory regarding the offer type check. Based on the comment, the function should only proceed if the offer type is Bid. It should revert for any other offer type.The code checks if the offer type is Ask and reverts if it is. This means it will allow any offer type that is not Ask, including Bid but also potentially other types if they exist.

This creates a logical contradiction where the function might allow offer types that it shouldn't, or disallow the very type it's supposed to accept.

/**
* @notice Close bid offer
* @dev caller must be offer authority
* @dev offer type must Bid
* @dev offer status must be Settling
* @dev refund amount = offer amount - used amount
*/
function closeBidOffer(address _offer) external {
(
OfferInfo memory offerInfo,
MakerInfo memory makerInfo,
,
MarketPlaceStatus status
) = getOfferInfo(_offer);
​
​
if (_msgSender() != offerInfo.authority) {
revert Errors.Unauthorized();
}
​
​
if (offerInfo.offerType == OfferType.Ask) {
revert InvalidOfferType(OfferType.Bid, OfferType.Ask);
}
if (offerInfo.offerType == OfferType.Ask) {
revert InvalidOfferType(OfferType.Bid, OfferType.Ask);
}

Impact

This creates a logical contradiction where the function might allow offer types that it shouldn't, or disallow the very type it's supposed to accept. Valid Bid offers might be rejected, while invalid non-Bid offers (except Ask) might be accepted.

Tools Used

Manual Review

Recommendations

Align the code with the intended behavior

Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.