Incorrect calculation logic in function `PreMarkets.sol#abortBidTaker()`
Summary
Unexpected loss of funds may occur due to incorrect calculation logic in the PreMarkets.sol#abortBidTaker() function.
Vulnerability Details
In the PreMarkets.sol#abortBidTaker() function, depositAmount is calculated as follows.
Expressing this in a formula is as follows:
depositAmount = stockInfo.points * preOfferInfo.points / preOfferInfo.amount
As you can see, the units of stockInfo.points and preOfferInfo.points, and depositAmount and preOfferInfo.amount have to be same.
However, according to Woo's calculation formula, the unit of depositAmount is not calculated accurately.
In other words, the deposit amount is not calculated accurately, and therefore the maker refund amount cannot be calculated accurately.
The exact calculation formula is as follows:
depositAmount = stockInfo.points * preOfferInfo.amount / preOfferInfo.points
Impact
Unexpected loss of funds may occur.
Tools Used
Manual Review
Recommendations
It is recommended to modify the PreMarkets.sol#abortBidTaker() function as follows:
Lead Judging Commences
finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points
Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.