Submission Details
Severity:
improper check in core/PreMarkets::listOffer can cause unexpected behaviours
## Summary
The `PreMarkets::listOffer` function in the Solidity contract is intended to allow the listing of only "ask" offers for a given stock. However, there was an issue where the function mistakenly checked for "bid" offers instead, which could potentially lead to incorrect offers being listed.
## Vulnerability Details
The vulnerability is located in the withdraw function, defined as follows:
```javascript
/**
* @notice list offer
* @param _stock stock address
* @param _amount the amount of offer
* @param _collateralRate offer collateral rate
* @dev Only stock owner can list offer
* @dev Market place must be online
* @dev Only ask offer can be listed
*/
function listOffer(
address _stock,
uint256 _amount,
uint256 _collateralRate
) external payable {
.
.
.
if (stockInfo.stockType != StockType.Bid) {
revert InvalidStockType(StockType.Bid, stockInfo.stockType);
}
.
.
.
}
```
The function was originally designed to allow only "ask" offers to be listed. However, the code mistakenly checked for the "bid" offer type instead, which could result in an invalid type of offer being listed.
## Impact
```
@> Incorrect Offer Listings: The incorrect check for the "bid" type instead of "ask" could allow unintended offers to be listed, leading to potential business logic flaws and incorrect operations within the marketplace.
```
## Tools Used
- Manual code review
## Recommended Mitigation
To mitigate this vulnerability, modify the code to ensure that the function only allows "ask" offers to be listed. The corrected line should be:
```diff
function listOffer(
address _stock,
uint256 _amount,
uint256 _collateralRate
) external payable {
.
.
.
- if (stockInfo.stockType != StockType.Bid) {
- revert InvalidStockType(StockType.Bid, stockInfo.stockType);
- }
+ if (stockInfo.stockType != StockType.Ask) {
+ revert InvalidStockType(StockType.Ask, stockInfo.stockType);
+ }
.
.
.
}
```
Updates
Lead Judging Commences
0xnevi about 1 year ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
[invalid] finding-PreMarkets-listOffer-validate-offer-Type
Invalid, explicit check not required. listOffer is for subsequent makers that want to sell points again. Based on the original maker creating offer as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L137-L138), if offerType is ASK, the stockType will default to Bid type, so the check [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L330-L332) is sufficient in ensuring only ask offer can be listed
Prize pool breakdown
Total prize
27,750 USDC
nSLOC
1,22923
USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.