Tadle

Summary

When listing an offer, the new offer address is generated with the offerId that is stored in the stockInfoMap mapping, the problem is that this address can become occupied by another offer before the listing which will prevent the listing this offer.

Vulnerability Details

Users create offers by calling the createOffer function, this function generates makerAddr, offerAddr, and stockAddr addresses based on the current offerId.

For example offerId is 1

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L66

Then it increases the offerId by one, so offerId is currently 2.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L83

While the addresses were generated with the previous offerId of 1, but the new offerId of 2 will be saved in both the offerInfoMap and stockInfoMap mappings.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L116

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L134

Another user creates an offer, the above process will be repeated, and the current offerId will be 3, while the makerAddr, offerAddr, and stockAddr addresses will be generated with the value of 2.

When the user tries to list the first offer they are going to encounter a revert because listOffer first, read the stockInfo from the stockInfoMap mapping.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L308

Then it generates the offerAddress from the stockInfo.id, but the stockInfo.id is 2, and the second offer was created with the same value. So at the time of calling the listOffer function the offerInfoMap[2] is not empty, and the following check will revert with OfferAlreadyExist.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L364

Impact

When this happens nobody will be able to list that particular offer

Tools Used

Manual Analysis

Recommendations

Use the offerId variable to generate the address

Then increase the variable