Tadle

Tadle
DeFiFoundry
27,750 USDC
View results
Submission Details
Severity: low
Valid

`offerId` increment is wrong, leads to inconsistent state

Vulnerability Details 🔍 && Impact 📈

offerId state is meant to be the latest not used ID at PreMarket.sol. Yet in createOffer() they increase it and then use it, which is inconsistent. Fortunately I could not find any bad consequence as they only mess this up in the struct member id and not in the address key that acutally maps by id. So the only bad consequence is inconsistent incorrect state.

As all latter posible operations use the address Id instead of the id memeber of the struct, there is now latter execution problems derived from this.

â„šī¸ Note for judge 📘 If there is actually a bad consequence I've missed, I would kindly appriciate a severity increase.


Recommendations đŸŽ¯

In createOffer(), increase offerId latter, not here. But after struct creations, around here.


Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createOffer-offerId-increment-after

I believe this is valid low severity, although there is inconsistency here when using the correct `offerId` for assigning offerIds and generating the unique addresses as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L67-L69), this is purely an accounting error for offerIds. If we generate the offerId using current `offerId - 1`, the appropriate listing/taker orders can still be created against those offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!