Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`StockInfo.amount` is updated incorrectly in `createOffer()`

tigerfrake

Summary

The createOffer() function in the PreMarkets contract contains an inconsistency where params.amount, which represents the amount a user wants to sell or buy, is directly assigned to StockInfo.amount. However, StockInfo.amount should represent the collateral amountused for a sell or buy order.

Vulnerability Details

Inconsistency in createOffer() Function: The function assigns params.amount directly to StockInfo.amount.

///@dev update stock info
stockInfoMap[stockAddr] = StockInfo({
//...snip...
>> amount: params.amount
});

However, StockInfo.amount should represent the collateral amount, not the amount the user wants to trade.

// @param amount receive or used collateral amount when sell or buy.
struct StockInfo {
//..
>> uint256 amount;
//..
}

Impact

This creates inconsistency in the assignment opening ways for more calculations issues where this value is utilized.

Tools Used

Manual Review

Recommendations

Use the calculated collateral amount (transferAmount) based on params.amount and assign it to StockInfo.amount.

uint256 transferAmount = OfferLibraries.getDepositAmount( // @audit-info Use this value below
params.offerType,
params.collateralRate,
params.amount,
true,
Math.Rounding.Ceil
);
​
//...
​
stockInfoMap[stockAddr] = StockInfo({
id: offerId,
stockStatus: StockStatus.Initialized,
stockType: params.offerType == OfferType.Ask ? StockType.Bid : StockType.Ask,
authority: _msgSender(),
maker: makerAddr,
preOffer: address(0x0),
offer: offerAddr,
points: params.points,
- amount: params.amount
+ amount: transferAmount // @audit Corrected assignment
});
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points

Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.