Submission Details
Severity:
Front Running on Order Cancellations
Summary
The cancelX functions for bids, asks, and shorts are vulnerable to front running.
Vulnerability Details
There is no validation that maker == msg.sender in the create functions. An attacker could watch for transactions and insert their own before the legitimate one executes.
For example in createAsk():
function createAsk(
address maker,
// ...
) external {
// No check of maker == msg.sender
Ask storage a = askOrders.insert(
keccak256(abi.encodePacked(collateralAmount, //...));
// Front run possible
}
Impact
Attacker could drain funds by filling their own orders before the user.
Tools Used
Manual
Recommendations
Add onlyMaker modifier to create functions:
modifier onlyMaker(address maker) {
require(maker == msg.sender, "Not maker");
_;
}
function createAsk(
address maker,
// ...
) external onlyMaker(maker) {
// ...
}
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.