Tadle

Tadle
DeFi
30,000 USDC
View results
Submission Details
Severity: medium
Invalid

ASK Makers will not be able to call listOffer

Summary

The `listOffer` function is expected to be called whenever users what to list some points they have for trade

Vulnerability Details

stockType: params.offerType == OfferType.Ask
? StockType.Bid
: StockType.Ask,
In the process the `stockInfo.offer` is also set to the generated offerAddr as shown below
offer: offerAddr,
now that the offer is set to the generated address listOffer function which users can call to list their points for trade has the following check
if (stockInfo.offer != address(0x0)) {
revert OfferAlreadyExist();
}
What the above check does is to make sure the `stockInfo.offer` is always `address(0x0)` meaning that the ASK Makers will not call this as whenever the createOffer is called the `stockInfo.offer` is set to the offerAddr generated.
Based on Docs: Use `createOffer` to initiate an offer and save it as an unlisted draft.
Use `listOffer` to officially list an existing draft offer so that other users can see it and create taker orders.

Impact

Proof of Concept (PoC):
Scenario Setup:
A user creates an offer with `createOffer` where `offerType = ASK`. This results in the stock being of type `BID` and assigns an offer address to `stockInfo.offer`.
The `listOffer` function is then called, which checks if `stockInfo.offer == address(0x0)`. If it is not, the function reverts with the "`OfferAlreadyExist`" error.
Result:
If stockInfo.offer is already set `(as would be the case after a successful createOffer call)`, the listOffer function will prevent listing new offers, even though the stock type is correctly set to `BID`.
Example:
A user with an existing ASK offer tries to call `listOffer` to list the offer, but the function reverts because it detects that `stockInfo.offer != address(0x0)`, which is inconsistent with the intended functionality.

Tools Used

manual Review

Recommendations

Allow users who create offer of type ASK to call this function. Modify the function to properly handle cases where an existing offer is associated with the stock. Ensure it correctly distinguishes between initial and subsequent offers.
Updates

Lead Judging Commences

0xnevi Lead Judge
10 months ago
0xnevi Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.