Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Validation of `collateralRate` Allows for undercollateralization

tigerfrake

Summary

The createOffer() function in the PreMarkets contract requires that collateralRate be more than 100% as specified in this comment.
However, the current implementation does not enforce this requirement correctly.

Vulnerability Details

Current Check:

if (params.collateralRate < Constants.COLLATERAL_RATE_DECIMAL_SCALER) {
revert InvalidCollateralRate();
}

Issue:
The check only reverts if params.collateralRate is less than 10000. This allows params.collateralRate to be exactly 10000, which is 100%.

Impact

Financial Risk:
Allowing collateralRate to be 100% can lead to insufficient collateralization, increasing the risk of default and financial loss.

Tools Used

Manual Review

Recommendations

Update the check to ensure params.collateralRate is strictly more than 10000.

- if (params.collateralRate < Constants.COLLATERAL_RATE_DECIMAL_SCALER) {
+ if (params.collateralRate <= Constants.COLLATERAL_RATE_DECIMAL_SCALER) {
revert InvalidCollateralRate();
}
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-off-by-one-Collateral-Rate-100%

I believe this is borderline informational/low. Despite this off-by-one error of the intended check, the difference between 100% and 101% is minimal, so I believe whether or not 100% is allowed has minimal impact. Ultimately, it still comes down to the risk level that users are willing to take

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.