DittoETH

Summary

Canceling orders via the OrdersFacet.cancelOrderFarFromOracle function does not refund the users' escrowed funds.

Vulnerability Details

According to the docs, the OrdersFacet.cancelOrderFarFromOracle function is used to handle the scenario when the orderId is close to the limit, i.e., type(uint16).max (65,535), used to deter attackers spamming the order book.

However, by using this function and canceling orders, the users owning the orders do not get their initially escrowed ETH/ERC-20 funds refunded. This is different from the regular canceling functions, e.g., the OrdersFacet.cancelShort function which refunds the user in line 95.

This cancelOrderFarFromOracle function is seemingly intended to mitigate order book spamming attacks. However, in the case that the order book contains many legitimate orders (due to having many users placing orders across a wide price range), the users will lose their escrowed funds when canceling their orders.

contracts/facets/OrdersFacet.sol#L124-L178

Impact

The owners (users) of the canceled orders will lose their escrowed funds.

Tools Used

Manual Review

Recommendations

Consider refunding the users' escrowed funds when canceling orders via the cancelOrderFarFromOracle function.

Even if the order book was spammed by an attacker, refunding the attackers' escrowed funds is acceptable as the order book will be cleared again, and if the attacker attempts to repeat the attack, the attacker has to cover the extensive gas costs.