Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong calculation in abortBidTaker(address, address) when calculating depositAmount

matejdb

Summary

During bid takers abort of an offer, there is a wrong calculation of the transfer amount that is to be added to the senders token balance.

Vulnerability Details

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L671C1-L675C11

As we can see in the code snippet, stock points are multiplied with offer points and divided by the offer amount which does not make sense and leads to an incorrect calculation of the transferAmount.

Impact

Incorrect amount is added to the senders token balance introducing a disbalance in the protocols overall funds.
We detect this to be of HIGH severity because funds are lost for users due to mishandling funds (wrong calculation).

Tools Used

manual review

Recommendations

Rewrite the calculation to following:

uint256 depositAmount = stockInfo.points.mulDiv(
preOfferInfo.amount,
preOfferInfo.points,
Math.Rounding.Floor
);
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-abortBidTaker-amount-wrong-StockInfo-points

Valid high severity, due to incorrect computation of `depositAmount` within `abortBidTaker`, when aborting bid offers created by takers, the collateral refund will be completely wrong for the taker, and depending on the difference between the value of `points` and `amount`, it can possibly even round down to zero, causing definite loss of funds. If not, if points were worth less than the collateral, this could instead be used to drain the CapitalPool contract instead.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.