Zaros Part 1

Summary

A discrepancy exists between the implemented fill price validation logic and the comments in the fillOffchainOrders function of the SettlementBranch contract. This discrepancy could lead to incorrect order execution, financial losses, and market manipulation.

Vulnerability Details

The code checks if the fill price is valid based on whether the order is a buy or sell order.

While the comment states that

The implemented logic is totally opposite of what is described in the comments.

Impact

The discrepancy between the intended validation logic and the implemented code can lead to malicious actors exploiting this discrepancy to execute buy orders with prices higher than the target price or sell orders with prices lower than the target price, causing financial losses.

Tools Used

Manual Review

Recommendations

Ensure that the validation logic accurately reflects the intended behavior. The correct logic should be;