createOffer() doesn't properly account for both the quantity (points) and price (amount) of the offer
Summary
The implementation only considers params.amount (price) and not params.points (quantity) when calculating the collateral.
Vulnerability Details
The current implementation only uses params.amount and params.collateralRate to determine the collateral, ignoring params.points.
The collateral rate should be applied to the total value of the offer (points * amount), not just the amount.
Impact
The bug could lead to under-collateralized positions, especially for offers with high quantities.
Tools Used
Manual review
Recommendations
The collateral should be based on the total value of the offer, which is the product of quantity and price
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.