DittoETH

Summary

Potential Yield Reward Loss for Highest Bid Order.

Vulnerability Details

The creationTime timestamp for the highest bid order is prematurely reset during the execution of the LibOrders#_updateOracleAndStartingShort function. This function calls LibOracle#setPriceAndTime:

This modifies the creationTime of the order, which is essential for determining how much reward in ditto tokens the order creator is entitled to. The reward calculation is done in the LibOrders#increaseSharesOnMatch function:

Here, the timeTillMatch determines how much reward the user receives, and it's based on the difference between the current time and the order's creationTime. If an order has been active for more than 14 days, it earns a specific reward.

However, since LibOrders#_updateOracleAndStartingShort resets the creationTime before the reward is calculated, the user might not receive the correct amount of reward for their active duration.

Impact

The individual who created the highest bid order might not receive the correct amount of Ditto token yield reward due to them.

Tools Used

Manual

Recommendations

Invoke LibOrders#increaseSharesOnMatch before executing setPriceAndTime to ensure accurate yield reward calculations.