Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`tradeTax` is not update in offerInfo struct while creating taker

0xaraj

Summary

tradeTax is not update in offerInfo mapping while creating taker

Vulnerability Details

When a user create taker then they pay tradeTax, which should store in offerInfo.tradeTax just like how usedPoints are getting stored in offerInfo.usedPoints. But the problem is it's only calculated but not updated in offerInfo struct

function createTaker(address _offer, uint256 _points) external payable {
...
/// @dev Transfer token from user to capital pool as collateral
uint256 depositAmount = _points.mulDiv(offerInfo.amount, offerInfo.points, Math.Rounding.Ceil);
uint256 platformFee = depositAmount.mulDiv(platformFeeRate, Constants.PLATFORM_FEE_DECIMAL_SCALER);
@> uint256 tradeTax = depositAmount.mulDiv(makerInfo.eachTradeTax, Constants.EACH_TRADE_TAX_DECIMAL_SCALER);
​
ITokenManager tokenManager = tadleFactory.getTokenManager();
_depositTokenWhenCreateTaker(platformFee, depositAmount, tradeTax, makerInfo, offerInfo, tokenManager);
​
offerInfo.usedPoints = offerInfo.usedPoints + _points;
​
/// @dev update stock info
stockInfoMap[stockAddr] = StockInfo({
id: offerId,
stockStatus: StockStatus.Initialized,
stockType: offerInfo.offerType == OfferType.Ask ? StockType.Bid : StockType.Ask,
authority: _msgSender(),
maker: offerInfo.maker,
preOffer: _offer,
points: _points,
amount: depositAmount,
offer: address(0x0)
});
​
offerId = offerId + 1;
uint256 remainingPlatformFee =
_updateReferralBonus(platformFee, depositAmount, stockAddr, makerInfo, referralInfo, tokenManager);
​
makerInfo.platformFee = makerInfo.platformFee + remainingPlatformFee;
​
_updateTokenBalanceWhenCreateTaker(_offer, tradeTax, depositAmount, offerInfo, makerInfo, tokenManager);
}

Impact

Low, as there is no loss of funds

Tools Used

Manual Review

Recommendations

Add this line in preMarket.createTaker()

+ offerInfo.tradeTax = offerInfo.tradeTax + tradeTax;
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createTaker-offerInfo-tradetax-settledCollateralAmount-not-updated

Borderline low/informational, tradeTax is posted by the original maker when creating an offer within the `makerInfo` mapping as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L112C13-L112C25). and is simply a placeholder for the offerInfo mapping. Given it can impact details of offer regarding the tradeTax, low severity seems appropriate. Similar reasonings apply for settledCollateralAmount.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.