Submission Details
Severity:
Ability to cancel multiple orders in a cycle
Summary
Hacker could cancel orders in for loop.
Vulnerability Details
Contract has function cancelOrderFarFromOracle(), which allow everyone cancel last order. And user could cancel only 1 order in each call. But user could make calls in loop.
Impact
Hacker could call function cancelOrderFarFromOracle() in for loop.
function testCancelOrderIfOrderIDTooHighShort() public {
setOrderIdAndMakeOrders({orderType: O.LimitShort});
vm.startPrank(hacker);
STypes.Order[] memory bids = getShorts();
assertEq(bids.length, 5);
for(uint16 i=64999; i > 64995;i-- ) {
diamond.cancelOrderFarFromOracle({
asset: asset,
orderType: O.LimitShort,
lastOrderId: 64999,
numOrdersToCancel: 1
});
}
bids = getShorts();
assertEq(bids.length, 0);
Tools Used
Manual review
Recommendations
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.