Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Invalid calculation of the refund amount in the `PreMarkets.abortBidTaker()` function leading to loss of funds.

eeyore

Summary

The calculations are incorrect due to the use of the wrong denominator when calculating depositAmount, which is later used to calculate the refund amount.

Vulnerability Details

Consider the following code:

File: PreMarkets.sol
671: uint256 depositAmount = stockInfo.points.mulDiv(
672: preOfferInfo.points, // <== incorrect; should be preOfferInfo.amount
673: preOfferInfo.amount, // <== incorrect denominator; should be preOfferInfo.points
674: Math.Rounding.Floor
675: );

The incorrect calculation of depositAmount can be exploited by an attacker. Here is how:

  1. An attacker, as a Maker, creates a Bid offer to buy 1,000,000 Points for 1 unit of USDC (0.000001 USD).

  2. The attacker, as a Taker, accepts the Bid offer, paying 1 unit of USDC.

  3. The Bid offer is aborted to finalize the attack.

  4. The attacker calls PreMarkets.abortBidTaker(), resulting in the following calculations:

depositAmount = 1,000,000 * 1,000,000 / 1 = 1,000,000,000,000
transferAmount = depositAmount * collateralRate / COLLATERAL_RATE_DECIMAL_SCALER =
1,000,000,000,000 * 10,000 / 10,000 = 1,000,000,000,000

As a result, the attacker’s balance is increased by 1 million USDC.

Impact

  • Loss of funds.

Tools Used

Manual review.

Recommendations

Correct the calculation of depositAmount:

File: PreMarkets.sol
671: uint256 depositAmount = stockInfo.points.mulDiv(
-672: preOfferInfo.points,
+672: preOfferInfo.amount,
-673: preOfferInfo.amount,
+673: preOfferInfo.points,
674: Math.Rounding.Floor
675: );
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points

Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.