003.md

Happy Rouge Coyote

Medium

Delete functions lacks mapping updates

Summary

The _deleteAuctionOrder function aims to remove an auction order from the active orders list and update necessary mappings to reflect the deletion. However, there is an overlooked issue: the function does not update the isAuction mapping to reflect that the auction is no longer active.

The deleteBorrowOffer is also aims to remove an borrow order but does not update isBorrowOrderLegit mapping.

The deleteOrder lacks updates on isLendOrderLegit mapping

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Giving example for first case.

The _deleteAuctionOrder function does not reset isAuction[_AuctionOrder] to false upon deletion. This means that even after an auction order is deleted, isAuction[_AuctionOrder] will remain true, inaccurately marking the auction order as active in the system.

PoC

No response

Mitigation

Giving example for first case.

Add missing sets to the _deleteAuctionOrder function

    function _deleteAuctionOrder(address _AuctionOrder) external onlyAuctions {
        // get index of the Auction order
        uint index = AuctionOrderIndex[_AuctionOrder];
        AuctionOrderIndex[_AuctionOrder] = 0;

        // get last Auction order
        allActiveAuctionOrders[index] = allActiveAuctionOrders[
            activeOrdersCount - 1
        ];
        // take out last Auction order
        allActiveAuctionOrders[activeOrdersCount - 1] = address(0);

        // switch index of the last Auction order to the deleted Auction order
        AuctionOrderIndex[allActiveAuctionOrders[index]] = index;
        activeOrdersCount--;
+       isAuction[_AuctionOrder] = false;
    }