Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing `StockType` Verification in `abortBidTaker()` Function

tigerfrake

Summary

The abortBidTaker() function in the PreMarkets contract is intended to abort bid taker. However, the function does not verify that the stock being aborted is of the Bid type. This oversight can lead to unintended behavior, allowing non-bid stocks to be aborted.

Vulnerability Details

closeBidTaker() ensures that the stock type must Bid:

if (stockInfo.stockType == StockType.Ask) {
revert InvalidStockType();
}

However, abortBidTaker() function does not check if the stock being aborted is of the Bid type.

function abortBidTaker(address _stock, address _offer) external {
StockInfo storage stockInfo = stockInfoMap[_stock];
OfferInfo storage preOfferInfo = offerInfoMap[_offer];
​
if (stockInfo.authority != _msgSender()) {
revert Errors.Unauthorized();
}
​
if (stockInfo.preOffer != _offer) {
revert InvalidOfferAccount(stockInfo.preOffer, _offer);
}
​
if (stockInfo.stockStatus != StockStatus.Initialized) {
revert InvalidStockStatus(
StockStatus.Initialized,
stockInfo.stockStatus
);
}
​
if (preOfferInfo.abortOfferStatus != AbortOfferStatus.Aborted) {
revert InvalidAbortOfferStatus(
AbortOfferStatus.Aborted,
preOfferInfo.abortOfferStatus
);
}
​
//...snip...
​
emit AbortBidTaker(_offer, _msgSender());
}

The function should explicitly verify that the stock type is Bid before proceeding with the abortion process.

Impact

Non-bid stocks could be aborted, violating the intended functionality and rules of the platform.

Tools Used

Manual Review

Recommendations

Add a check to ensure the stock type is Bid before aborting

+ // Add check to ensure the stock type is Bid
+ if (stockInfo.stockType == StockType.Ask) {
+ revert InvalidStockType();
+ }
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-lack-check-Bid-Type

Low severity, the check is indeed missing for `abortBidTaker`, however, this would be contingent on user error and the funds are not locked, given admin can rescue them via `Rescuable.sol`

finding-Premarkets-listOffer-lack-check-abort-relist

Leaving high severity for now but will leave open for appeals. Technically, users can choose not to transact this type offers if they are aware of such undercollaterized relisted offers, in which case it will have no impact. However, if subsequent takers transact this relisted offers, this can allow profits without having to settle any points.

Appeal created

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-lack-check-Bid-Type

Low severity, the check is indeed missing for `abortBidTaker`, however, this would be contingent on user error and the funds are not locked, given admin can rescue them via `Rescuable.sol`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.