Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

PreMarkets::abortBidTaker allows unexpected amount of tokens to be refund by aborters

radin100

Summary

PreMarkets::abortBidTaker adds unexpected amount of tokens into callers withdrawable balance, due to bad depositedAmount calculation

Vulnerability Details

Let's have a scenario

  1. Alice creates askOffer and Bob makes bidOrder on it and he deposits X amount of underlying token and based on point/amount Ratio, now he have X*Ratio points recorded in his stockInfo.

  2. After some time Alice decides to abort her offer, by calling PreMarkets::abortAskOffer, now the abortStatus of her offer is marked as Aborted

  3. Now the only think that Bob can do to get his X amount of funds back is to execute PreMarkets::abortBidTaker

But because of this calculation:

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L671C7-L675C11

uint256 depositAmount = stockInfo.points.mulDiv(
preOfferInfo.points,
preOfferInfo.amount,
Math.Rounding.Floor
);
​

Bob now is able to withdraw X * (Ratio^2) amount of underlying tokens instead of the expected X amount

Impact

Loss of funds for protocol users that deposited funds into CapitalPool, due to aborters too big refund allowance

Tools Used

Manual review

Recommendations

function abortBidTaker(address _stock, address _offer) external {
...
​
uint256 depositAmount = stockInfo.points.mulDiv(
- preOfferInfo.points,
preOfferInfo.amount,
+ preOfferInfo.points,
Math.Rounding.Floor
);
​
...
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points

Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!