Tadle

Summary

In PreMarkets::abortBidTaker(...) function, there is a critical miscalculation of the taker's deposited collateral, causing incorrect collateral refunds either by paying less or more than deserved.

Vulnerability Details

Let's establish what depositAmount is first, in the context of abortBidTaker(...). It represents the amount of funds that were originally deposited by the taker when they placed their bid. This is calculated based on the taker's points and the offer's points and amount. Fundamentally, it should be calculated as:

taker amount = total amount * (taker points / total points) ✅.

However, the current implementation incorrectly flips the points ratio:

taker amount = total amount * (total points / taker points) ❌, which is translated from the following code snippet:

The depositAmount is used to calculate the transferAmount, which is the amount of funds to be transferred back to the taker when they abort their bid.

Impact

Incorrect refunds for takers, the wrong points ratio(total points / taker points) is >1 which will inflate the amount of refund for early refundees, and cause loss of funds for late ones.

Tools Used

Manual review.

Recommendations