Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Ineffective updates to `originOfferInfo.abortOfferStatus` in `listOffer()` function

gajiknownnothing

Summary

The listOffer() function does not correctly update the originOfferInfo.abortOfferStatus to AbortOfferStatus.SubOfferListed for Turbo offers, causing these offers can still be aborted even after having sub-offers. Users who bids on sub Turbo offers cannot be settled properly.

Vulnerability Details

In the listOffer() function, Turbo offers should update the abortOfferStatus to AbortOfferStatus.SubOfferListed to prevent them from being aborted once sub-offers are created. However, the code mistakenly updates a local memory copy of originOfferInfo rather than the actual state in storage:

File: PreMarkets.sol
295: function listOffer(
...
335: if (makerInfo.offerSettleType == OfferSettleType.Turbo) {
336: address originOffer = makerInfo.originOffer;
337:> OfferInfo memory originOfferInfo = offerInfoMap[originOffer];
338:
339: if (_collateralRate != originOfferInfo.collateralRate) {
340: revert InvalidCollateralRate();
341: }
342:> originOfferInfo.abortOfferStatus = AbortOfferStatus.SubOfferListed;
343: }

As a result, the abortOfferStatus remains Initialized even after sub-offers are listed, leading to Turbo offer does not reflect that it has sub-offers and can be wrongly aborted since the condition in abortAskOffer() checks for abortOfferStatus being different from Initialized.

File: PreMarkets.sol
536: function abortAskOffer(address _stock, address _offer) external {
...
552: if (offerInfo.abortOfferStatus != AbortOfferStatus.Initialized) {
553: revert InvalidAbortOfferStatus(
554: AbortOfferStatus.Initialized,
555: offerInfo.abortOfferStatus
556: );
557: }

Impact

Turbo offers can be aborted even if sub-offers are created. Users who interact with these offers cannot be settled and could experience financial losses.

Tools Used

vscode

Recommendations

- OfferInfo memory originOfferInfo = offerInfoMap[originOffer];
+ OfferInfo storage originOfferInfo = offerInfoMap[originOffer];
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-listOffer-originIOfferInfo-storage-memory

Valid high severity, because the `abortOfferStatus` of the offer is not updated and persist through `storage` when listing an offer for turbo mode within the `offerInfoMap` mapping, it allows premature abortion given the `abortOfferStatus` defaults to `Initialized`, allowing the bypass of this [check](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L552-L557) here and allow complete refund of initial collateral + stealing of trade tax which can potentially be gamed for profits using multiple addresses

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.