Zaros Part 1

Summary

fillOffchainOrders can be DOS leading to a failure in fulfilling all orders.

Vulnerability Details

fillOffchainOrders and _fillOrder functions have many "if...revert..." codes. For example:

If the function reverts, it will prevent all orders from being fulfilled. OffchainOrdersKeeper has responsibility to call fillOffchainOrders and fills pending, eligible offchain offchain orders targeting the given market id. So we can assume OffchainOrdersKeeper can filter orders to ensure this fillOffchainOrders function call doesn't revert. However malicious user can front-run the fillOffchainOrders tx and change the account state to force the fillOffchainOrders call to fail continuously.
Attack path 1:

1. user A submits offchain order

2. keeper packs A's order and call fillOffchainOrders

3. A monitors the memepool. Once he finds the keeper's fillOffchainOrders tx, he front run to transfer accountId(NFT) to another address

4. fillOffchainOrders tx revert because of ctx.signer != tradingAccount.owner

Attack path 2:

1. user A submits offchain order

2. keeper packs A's order and call fillOffchainOrders

3. A monitors the memepool. Once he finds the keeper's fillOffchainOrders tx, he front run to call cancelAllOffchainOrders

4. fillOffchainOrders tx revert because of ctx.offchainOrder.nonce != tradingAccount.nonce

It is noteworthy that Arbitrum(protocol deployed) has a centralised sequencer that is fair "first come, first server" at the moment. There is no MEV which is a major selling point for any trading activity. However, most transactions are broadcasted using JSON-RPC nodes from popular service providers, with eth_sendRawTransaction without directly communicating with the sequencer. JSON-RPC node operators are able to front run transactions if they are malicious. So front run is possible on Arbitrum. Related article: Arbitrum, MEV and frontrunning with centralised sequencer : r/Arbitrum (reddit.com).
From above examples, malicious user can continuously submit offchain order and monitor the memepool, then front run to force the fillOffchainOrders call to fail continuously. The cost for user to attack is only gas fee.

Impact

fillOffchainOrders can be DOS leading to a failure in fulfilling all orders.

Tools Used

manual

Recommendations

Redesign the fillOffchainOrders and _fillOrder to make a single order fail while allowing other orders to proceed.