Summary

OrdersFacet.cancelOrderFarFromOracle doesn't return order funds to owner.

Vulnerability Details

OrdersFacet.cancelOrderFarFromOracle can be called if there are a lot of orders in the order book to close some of them that are with lowest price. The function calls LibOrders.cancelOrder or LibOrders.cancelManyOrders to do so.

The problem is that both functions just make sure that order is removed from orderbook and order id is now marked as canceled so it can be used in the future. But refund was not done to order creator.

Even though, order is one of the last in the order book, doesn't mean that small amount funds was escrowed to it. As result user loses those funds.

Impact

Creator of canceled order loses funds.

Tools Used

VsCode

Recommendations

You need to return funds back to creator as it's done in other cancel functions.