Summary
The `listOffer` function is expected to be called whenever users what to list some points they have for trade
Vulnerability Details
stockType: params.offerType == OfferType.Ask
? StockType.Bid
: StockType.Ask,
In the process the `stockInfo.offer` is also set to the generated offerAddr as shown below
offer: offerAddr,
now that the offer is set to the generated address listOffer function which users can call to list their points for trade has the following check
if (stockInfo.offer != address(0x0)) {
revert OfferAlreadyExist();
}
What the above check does is to make sure the `stockInfo.offer` is always `address(0x0)` meaning that the ASK Makers will not call this as whenever the createOffer is called the `stockInfo.offer` is set to the offerAddr generated.
Based on Docs: Use `createOffer` to initiate an offer and save it as an unlisted draft.
Use `listOffer` to officially list an existing draft offer so that other users can see it and create taker orders.
Impact
Proof of Concept (PoC):
Scenario Setup:
A user creates an offer with `createOffer` where `offerType = ASK`. This results in the stock being of type `BID` and assigns an offer address to `stockInfo.offer`.
The `listOffer` function is then called, which checks if `stockInfo.offer == address(0x0)`. If it is not, the function reverts with the "`OfferAlreadyExist`" error.
Result:
If stockInfo.offer is already set `(as would be the case after a successful createOffer call)`, the listOffer function will prevent listing new offers, even though the stock type is correctly set to `BID`.
Example:
A user with an existing ASK offer tries to call `listOffer` to list the offer, but the function reverts because it detects that `stockInfo.offer != address(0x0)`, which is inconsistent with the intended functionality.
Tools Used
manual Review
Recommendations
Allow users who create offer of type ASK to call this function. Modify the function to properly handle cases where an existing offer is associated with the stock. Ensure it correctly distinguishes between initial and subsequent offers.