Tadle

Github

• https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L295

Summary

The listOffer function in the PreMarkets contract fails to validate the offer type before allowing it to be listed. The function is intended to only list ask offers, but this restriction is not enforced in the code. As a result, "bid" offers could potentially be listed, leading to incorrect contract behavior and unintended consequences.

Vulnerability Details

The listOffer function is responsible for listing an offer on the marketplace. According to the function's documentation, only "ask" offers should be eligible for listing:

However, there is no actual validation in the code to enforce this restriction. Specifically, the contract fails to check the offerType of the offer before listing it, which means that "bid" offers could be mistakenly listed.

This check only ensures that the stock type is correct but does not confirm that the offer itself is of the correct type ("ask").

Impact

The lack of validation could result in incorrect offer types being listed on the marketplace, leading to potential disruptions in the trading system. For example, if a "bid" offer is listed as an "ask" offer, it could create confusion among users, disrupt the market's order flow, and potentially lead to financial losses for traders relying on accurate market data.

Additionally, this vulnerability could be exploited by malicious actors to manipulate the marketplace, further exacerbating the potential financial and reputational damage.

Tools Used

Manual Review

Recommendations

Implement a validation check to ensure that only "ask" offers are listed in the listOffer function. This can be done by checking the offerType of the offer before proceeding with the listing