Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Wrong Calculation For PreMarkets::_updateTokenBalanceWhenCreateTaker

nave765

Summary

PreMarkets::_updateTokenBalanceWhenCreateTaker input the wrong parameter where token balance is sent to authority when offer type is ask and msg.sender when offer type is bid.

Vulnerability Details

offerinfo.authority is the offer owner as we can see in the PreMarkets::createOffer.

offerInfoMap[offerAddr] = OfferInfo({
id: offerId,
authority: _msgSender(),
maker: makerAddr,
__;
});

PreMarkets::_updateTokenBalanceWhenCreateTaker is called in PreMarkets::createTaker.

Let's assume a scenario where a user attempts to create a taker in an ask-offer system where points are sold. However, instead of the deposit amount being credited to the taker (msg.sender), it is incorrectly deposited to the offer owner (offerInfo.authority). Conversely, in the case of a bid offer, the deposit amount is mistakenly deposited to the taker (msg.sender) instead of the offer owner (offerInfo.authority).

function _updateTokenBalanceWhenCreateTaker(address _offer, uint256 _tradeTax, uint256 _depositAmount, OfferInfo storage offerInfo, MakerInfo storage makerInfo, ITokenManager tokenManager) internal {
__;
​
/// @dev update sales revenue
if (offerInfo.offerType == OfferType.Ask) {
tokenManager.addTokenBalance(
TokenBalanceType.SalesRevenue,
@> offerInfo.authority,
makerInfo.tokenAddress,
_depositAmount
);
} else {
tokenManager.addTokenBalance(
TokenBalanceType.SalesRevenue,
@> _msgSender(),
makerInfo.tokenAddress,
_depositAmount
);
}
}

Impact

Wrong calculation where the msg.sender will not get the token they paid for even thought they had deposited.

Tools Used

Manual Review

Recommendations

if (offerInfo.offerType == OfferType.Ask) {
tokenManager.addTokenBalance(
TokenBalanceType.SalesRevenue,
- offerInfo.authority,
+ _msgSender(),
makerInfo.tokenAddress,
_depositAmount
);
} else {
tokenManager.addTokenBalance(
TokenBalanceType.SalesRevenue,
- _msgSender(),
+ offerInfo.authority,
makerInfo.tokenAddress,
_depositAmount
);
}
Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!