Tadle

Summary

The createOffer function in the PreMarktes contract is susceptible to a front-running attack due to the delayed increment of the offerId. This vulnerability can allow an attacker to gain an unfair advantage in the marketplace by observing pending transactions and creating their own offer with a higher offerId.

Vulnerability Details

The createOffer function performs the following sequence of operations:

1. It performs various checks and calculations.

2. It generates addresses for the maker, offer, and stock using the current offerId.

3. It transfers tokens to the capital pool.

4. It updates the state variables makerInfoMap, offerInfoMap, and stockInfoMap.

5. It increments the offerId.

The vulnerability lies in the fact that offerId is incremented only after generating addresses and transferring tokens. This creates a window of opportunity for an attacker to observe the pending transaction, extract the offerId used, and quickly submit their own transaction with a slightly higher offerId and a higher gas price.

Impact

the marketplace uses offerId to determine priority or order in auctions or queues, an attacker could consistently outbid or jump ahead of other users.

Tools Used

Manual review

Recommendations

Move the offerId increment to the beginning of the createOffer function, before any other operations. This ensures that the offerId used for address generation and subsequent actions is already the next available one, preventing front-running based on predictable IDs.