Tadle

Tadle
DeFi
30,000 USDC
View results
Submission Details
Severity: low
Valid

`offerId` is updated before it is stored

Summary

The offerId is updated before it is stored.

Vulnerability Details

When creating an offer, the offer id is updated before being stored in offerInfoMap[offerAddr].id and stockInfoMap[stockAddr].id.
https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L83
https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L117
https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L135

So, basically when creating the first offer, offerId = 0, but the id is stored as 1 instead of 0:

  • offerInfoMap[offerAddr].id = 1

  • stockInfoMap[stockAddr].id = 1

Impact

  • Wrong storage of id in the mapping.

Tools Used

Recommendations

offerId should be updated at the end of the function createOffer, similar to how it is implemented in the function creatTrade:

offerId = offerId + 1;

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L253

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createOffer-offerId-increment-after

I believe this is valid low severity, although there is inconsistency here when using the correct `offerId` for assigning offerIds and generating the unique addresses as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L67-L69), this is purely an accounting error for offerIds. If we generate the offerId using current `offerId - 1`, the appropriate listing/taker orders can still be created against those offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.