Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users can create undercollateralized positions in Turbo mode

dadekuma

Summary

The original ASK offer maker can abort their offer AFTER it's relisted by a taker, resulting in undercollateralized positions.

Vulnerability Details

In Turbo Mode, the original seller deposits crypto as collateral, enabling subsequent traders to buy and sell points without additional collateral.

For the previous reason, it shouldn't be possible to abort a turbo offer after it's relisted, so the abort status is set to: AbortOfferStatus.SubOfferListed.

The issue is that this is done only in memory so the abortOfferStatus remains the same:

if (makerInfo.offerSettleType == OfferSettleType.Turbo) {
address originOffer = makerInfo.originOffer;
-> OfferInfo memory originOfferInfo = offerInfoMap[originOffer];
​
if (_collateralRate != originOfferInfo.collateralRate) {
revert InvalidCollateralRate();
}
originOfferInfo.abortOfferStatus = AbortOfferStatus.SubOfferListed;
}

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L337

This allows the original offer to abort after a relist in abortAskOffer:

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L552

Impact

Impact: High (Undercollateralized positions and bad debt)
Likelihood: High (No preconditions)

Risk: Critical

Tools Used

Manual review

Recommendations

if (makerInfo.offerSettleType == OfferSettleType.Turbo) {
address originOffer = makerInfo.originOffer;
- OfferInfo memory originOfferInfo = offerInfoMap[originOffer];
+ OfferInfo storage originOfferInfo = offerInfoMap[originOffer];
​
if (_collateralRate != originOfferInfo.collateralRate) {
revert InvalidCollateralRate();
}
originOfferInfo.abortOfferStatus = AbortOfferStatus.SubOfferListed;
}

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/PreMarkets.sol#L337

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-listOffer-originIOfferInfo-storage-memory

Valid high severity, because the `abortOfferStatus` of the offer is not updated and persist through `storage` when listing an offer for turbo mode within the `offerInfoMap` mapping, it allows premature abortion given the `abortOfferStatus` defaults to `Initialized`, allowing the bypass of this [check](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L552-L557) here and allow complete refund of initial collateral + stealing of trade tax which can potentially be gamed for profits using multiple addresses

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.