Tadle

Summary

A critical vulnerability exists in the PreMarkets contract related to the inability of bid takers to abort their positions. This is due to an inconsistent state requirement in the abortBidTaker function, which checks for an Aborted status that is dependent on the actions of the ask offer creator.

Vulnerability Details

The abortBidTaker function is designed to allow takers to abort their positions for an offer of type BID if the associated offer's abortOfferStatus is set to Aborted. the issue is that the ask offer is never aborted, bid takers might be unable to exit their positions through the abort mechanism. This means that even if an offer is created, the abortBidTaker function might not be able to proceed as it checks for an Aborted status. this means that an ask offer creator is given too much power could refuse to abort, preventing bid takers from using the abort mechanism.

Impact

1. Fund Locking: If the ask offer is never aborted, bid takers might be unable to exit their positions through the abort mechanism..

2. Inconsistent State: The contract could enter a state where offers and takers are trapped in a deadlock, unable to exit or modify their positions.

3. User Trust: This issue could cause significant damage to user trust if they are unable to recover their funds.

Tools Used

Manual Review

Recommendations

Introduce a mechanism to set the abortOfferStatus to Aborted under certain conditions for offers created via listOffer or similar functions.