Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Offer ID Inconsistency in PreMarkets Contract

salem

Summary

The PreMarkets contract's createOffer function generates addresses for offer and stock using one offerId, but then increments this ID before mapping and emitting offer information. This mismatch creates a severe inconsistency between the addresses generated and the offer data stored on-chain, potentially leading to numerous issues including data corruption, fund misallocation, and system-wide integrity compromise.

Vulnerability Details

address offerAddr = GenerateAddress.generateOfferAddress(offerId);
address stockAddr = GenerateAddress.generateStockAddress(offerId);
// ... other code ...
offerId = offerId + 1;
// Mapping and emitting using the incremented offerId

  • Addresses are generated with one offerId, but the offer is mapped and emitted with a different (incremented) offerId.

Impact

  • Incorrect linking between addresses and offer data.

Tools Used

Manual Review

Recommendations

ReStructure the createFunction

function createOffer(/* params */) external {
offerId = offerId + 1; // Increment first
address offerAddr = GenerateAddress.generateOfferAddress(offerId);
address stockAddr = GenerateAddress.generateStockAddress(offerId);
// ... rest of the function using the same offerId ...
}
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-createOffer-offerId-increment-after

I believe this is valid low severity, although there is inconsistency here when using the correct `offerId` for assigning offerIds and generating the unique addresses as seen [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L67-L69), this is purely an accounting error for offerIds. If we generate the offerId using current `offerId - 1`, the appropriate listing/taker orders can still be created against those offers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.