Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Assignment of id Field in `PreMarkets::listOffer` Function

pro_king

Description

In the PreMarkets::listOffer function, the id field of the OfferInfo struct is incorrectly assigned the stockInfo.id value instead of the offerInfo.id. Since the OfferInfo structure contains information directly related to the offer, including the unique identifier (id), it is crucial that the correct identifier is assigned to ensure accurate tracking and management of offers.

function listOffer(address _stock, uint256 _amount, uint256 _collateralRate) external payable {
if (_amount == 0x0) {
revert Errors.AmountIsZero();
}
​
if (_collateralRate < Constants.COLLATERAL_RATE_DECIMAL_SCALER) {
revert InvalidCollateralRate();
}
​
StockInfo storage stockInfo = stockInfoMap[_stock];
if (_msgSender() != stockInfo.authority) {
revert Errors.Unauthorized();
}
​
OfferInfo storage offerInfo = offerInfoMap[stockInfo.preOffer];
MakerInfo storage makerInfo = makerInfoMap[offerInfo.maker];
​
/// @dev market place must be online
ISystemConfig systemConfig = tadleFactory.getSystemConfig();
MarketPlaceInfo memory marketPlaceInfo = systemConfig.getMarketPlaceInfo(makerInfo.marketPlace);
​
marketPlaceInfo.checkMarketPlaceStatus(block.timestamp, MarketPlaceStatus.Online);
​
if (stockInfo.offer != address(0x0)) {
revert OfferAlreadyExist();
}
​
if (stockInfo.stockType != StockType.Bid) {
revert InvalidStockType(StockType.Bid, stockInfo.stockType);
}
​
/// @dev change abort offer status when offer settle type is turbo
if (makerInfo.offerSettleType == OfferSettleType.Turbo) {
address originOffer = makerInfo.originOffer;
OfferInfo memory originOfferInfo = offerInfoMap[originOffer];
​
if (_collateralRate != originOfferInfo.collateralRate) {
revert InvalidCollateralRate();
}
originOfferInfo.abortOfferStatus = AbortOfferStatus.SubOfferListed;
}
​
/// @dev transfer collateral when offer settle type is protected
if (makerInfo.offerSettleType == OfferSettleType.Protected) {
uint256 transferAmount = OfferLibraries.getDepositAmount(
offerInfo.offerType, offerInfo.collateralRate, _amount, true, Math.Rounding.Ceil
);
​
ITokenManager tokenManager = tadleFactory.getTokenManager();
tokenManager.tillIn{value: msg.value}(_msgSender(), makerInfo.tokenAddress, transferAmount, false);
}
​
address offerAddr = GenerateAddress.generateOfferAddress(stockInfo.id);
if (offerInfoMap[offerAddr].authority != address(0x0)) {
revert OfferAlreadyExist();
}
​
/// @dev update offer info
offerInfoMap[offerAddr] = OfferInfo({
@>>>> id: stockInfo.id,
authority: _msgSender(),
maker: offerInfo.maker,
offerStatus: OfferStatus.Virgin,
offerType: offerInfo.offerType,
abortOfferStatus: AbortOfferStatus.Initialized,
points: stockInfo.points,
amount: _amount,
collateralRate: _collateralRate,
usedPoints: 0,
tradeTax: 0,
settledPoints: 0,
settledPointTokenAmount: 0,
settledCollateralAmount: 0
});
​
stockInfo.offer = offerAddr;
​
emit ListOffer(offerAddr, _stock, _msgSender(), stockInfo.points, _amount);
}
​

Impact

Assigning the stockInfo.id instead of offerInfo.id can lead to several issues:

  1. Incorrect Data Association: The offer may be incorrectly associated with the wrong identifier, leading to inconsistencies in the system and potential mismanagement of offers.

  2. Tracking and Auditing Issues: It may become difficult to track, audit, and verify the details of specific offers if they are not correctly identified.

  3. Potential Security Risks: If the system relies on the correct identification of offers for security checks or authorization, this bug could be exploited to perform unauthorized actions or manipulate offer data.

Tools Used

Manual Review

Recommendations

Replace the assignment of stockInfo.id with offerInfo.id in the offerInfoMap update section to ensure the correct identifier is used for the offer. This will ensure that each offer is accurately tracked and associated with the correct data.

offerInfoMap[offerAddr] = OfferInfo({
- id: stockInfo.id,
+ id: offerInfo.id,
authority: _msgSender(),
maker: offerInfo.maker,
offerStatus: OfferStatus.Virgin,
offerType: offerInfo.offerType,
abortOfferStatus: AbortOfferStatus.Initialized,
points: stockInfo.points,
amount: _amount,
collateralRate: _collateralRate,
usedPoints: 0,
tradeTax: 0,
settledPoints: 0,
settledPointTokenAmount: 0,
settledCollateralAmount: 0
});
​
​
Updates

Lead Judging Commences

0xnevi Lead Judge
11 months ago
0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.