Tadle

Summary

The Virgin offer will always get less collateralFee than excepted which leads to loss to Offer Authority.

Vulnerability Details

Note :-

Virgin Check

1. CloseOffer()

2. CloseBidOffer()

3. SettleAskMaker()

Virgin Update

1. CreateOffer()

2. ListOffer()

3. reListOffer()

Settle check

1. CloseBidTaker()

Settle Update

1. AbortAskOffer()

2. SettledAskOffer()

3. CloseBidOffer()

4. SettleAskMaker()

The above function will be needed to describe this issue

As we know that sell means ask and buy means bid ordr. Let's consider that CreateTaker() will be called to buy points from the targeted offer. Then the sublisted offer will be created through the listedOffer() function then called the closeOffer() function to close offer which not needed then settleAskMaker() function will be called main issue here in this settleAskOffer() function is called which sets the offer as Settled offer Status until here the offer was Virgin state.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/DeliveryPlace.sol#L310C1-L311C1

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L746C1-L746C53

The CloseBidTaker() function will only be called for offers that are in the Settled state, as shown in the code snippet below. Users can only call this function for offers that have entered the settled state. We also need to check that the collateral fee is calculated only if the offer is in the virgin state. However, since it is already in the settled state, it will enter the else block.

The PreOffer or the Offer, once marked as Settled before it is Virgin, will have the collateral fee calculated using the offerInfo.amount. However, closeBidTaker() won't allow this and will always enter the else block. Consequently, the collateral fee amount will be calculated using usedAmount, which will always result in a loss for the user or the authority.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/DeliveryPlace.sol#L143C7-L173C40

Impact

If Origin Offer or the Sub listed offer is Virgin then Will get always less collateralFee due to settled and virgin both check in closeBidTaker() function.

Tools Used

Foundry , Manual View

Recommendations

Implement the addtional varaible to store the offer status before entering into an settled state if the virgin offer entered to settled state means after settle as maker then stored variable can be indicate that it was virgin then the collateral amount will be calculated as intended.