Tadle

Summary

Vulnerability Detail

The PreMarkets contract implements a decentralized marketplace where users can create and interact with offers. The closeOffer() function is designed to allow offer creators to close their offers, effectively removing them from the marketplace. However, the current implementation of this function contains a logical flaw that prevents offer creators from closing offers that have been previously canceled.

In the closeOffer() function, there's a status check that only allows offers with the status Virgin to be closed:

This check is overly restrictive as it prevents offer creators from closing offers that have been canceled but not yet formally closed. The OfferStatus enum likely includes a Canceled state, which should also be a valid state for closing an offer.

By only allowing Virgin offers to be closed, the contract creates a scenario where canceled offers remain in a limbo state, unable to be fully removed from the system. This can lead to inconsistencies in offer management and potentially confuse users and administrators about the true state of offers in the marketplace.

Impact

The primary impact of this finding is the inconsistency it introduces in the offer lifecycle management. Offers that have been canceled cannot be formally closed, leading to operational confusion and potential for stale data.

Proof of Concept

1. Alice creates an offer using the createOffer() function. The offer status is set to Virgin.

2. Alice decides to cancel the offer using a cancelOffer() function (not shown in the provided code snippet). The offer status is changed to Canceled.

3. Alice attempts to close the canceled offer using the closeOffer() function.

4. The transaction reverts due to the InvalidOfferStatus error, as the offer is no longer in the Virgin state.

5. Alice is unable to fully close and remove her canceled offer from the system.

Tools Used

Manual review

Recommendation

Update the status check in the closeOffer() function to allow both Virgin and Canceled offers to be closed. This will ensure that offer creators can properly manage the full lifecycle of their offers, including closing those that have been canceled.

Here's the recommended change:

This change allows offer creators to close both Virgin and Canceled offers, ensuring proper offer lifecycle management and improving