Incorrect `depositAmount` calculation in abortBidTaker
Summary
In abortBidTaker(), when we calculate depositAmount, we use stockInfo.points * preOfferInfo.points/ preOfferInfo.amount. This is incorrect. The correct calculation should be stockInfo.points * preOfferInfo.amount / preOfferInfo.points.
Vulnerability Details
In PreMarkets, the ask maker can choose to abort the ask offer. And the related bid takers can get back the collateral amount which were used to buy points. Considering that there may be several bid takers, each bid taker's collateral amount should be calculated according to the point amount they buy.
The problem is that the calculation of depositAmount. We use stockInfo.points * preOfferInfo.points/ preOfferInfo.amount. This is incorrect. The correct calculation should be stockInfo.points * preOfferInfo.amount / preOfferInfo.points.
Impact
The calculation of depositAmount is incorrect. The bid taker may not get back the expected collateral amount.
For example, points is 10000. And the collateral amount is 1e18. The deposit amount will be zero. The bid takers will lose all their collateral.
Tools Used
Manual
Recommendations
Correct the calculation of depositAmount.
Lead Judging Commences
finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points
Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.