Zaros Part 1

Summary

The fill price validation logic for buy and sell orders is incorrectly implemented, potentially allowing trades to execute at unfavorable prices.

Vulnerability Details

In fillOffchainOrders(), the fill price is validated as follows:

However, this is implemented as follows:

Logical Error:

1. Buy Order: The fill price should be less than or equal to the target price.

2. Sell Order: The fill price should be greater than or equal to the target price.

But as seen, the current does not correctly enforce these conditions.

Example Scenario
Buy Order

• Target Price: $100

• Fill Price: $105

Incorrect Validation: The current logic will incorrectly validate this fill price as acceptable when such a trade should be rejected.

Impact

Traders may have their orders executed at unfavorable prices, leading to potential financial losses.

Tools Used

Manual Review

Recommendations

To ensure the correct validation of the fill price, the logic should correctly handle the conditions for both buy and sell orders.