Summary

The logic of this protocol will cancel orders which only have a dust amount of erc remaining. However, this dust amount is never accounted for, and if/when it builds up across a large volume of orders, there is no accounting for this amount of tokens which should be eventually withdrawable, and also lack of any functionality to withdraw these funds.

Vulnerability Details

The LibOrders:sellMatchAlgo contains logic for cancelling orders which only have a dust amount of erc tokens left. This can be seen in the following code snippet:

The order is completely filled, and the dustErcAmount is never recorded anywhere. This effectively prevents (along with the lack of functionality) withdrawing this amount as it accumulates over time.

Impact

Lack of accounting of/logic for withdrawing dust amount of erc tokens can lead to loss of these funds, as they might build up to a large amount over time.

Tools Used

Manual review

Recommendations

Increment a state variable by the amount of dustErcAmount which is not used from an order, and add a function to withdraw this.