Summary

The cancelMarketOrder function in the OrderBranch contract does not verify the existence of a market order before attempting to clear it. If a market order does not exist for the given tradingAccountId, the function's behavior is undefined and could lead to errors or unexpected outcomes.

Vulnerability Details

The cancelMarketOrder function is intended to cancel an active market order associated with a specific tradingAccountId. However, it directly calls the MarketOrder.loadExisting(tradingAccountId) function, which will revert if no active market order exists for the given account. This means that the function will fail if there is no order to cancel, potentially disrupting the user experience and causing confusion.

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/OrderBranch.sol#L391

Impact

If a user attempts to cancel a non-existent market order, the transaction will revert, wasting gas fees and potentially causing frustration.

Tools Used

Manual review

Recommendations

Before calling MarketOrder.loadExisting, add a check to verify if an active market order exists for the given tradingAccountId. This can be done by directly checking the storage slot associated with the market order or by adding a helper function to the MarketOrder library to check for existence.