Zaros Part 1

Vulnerability Details

In the MarketOrder.sol contract, the checkPendingOrder() function is responsible for determining whether a pending market order can be modified or cancelled.

The function implements a check to ensure that a minimum lifetime has passed before an order can be modified. However, the current implementation contains a logical error in this check:

MarketOrder.sol#L59-L64

The issue lies in the comparison block.timestamp - self.timestamp <= marketOrderMinLifetime. This condition block an order to be modified when the minimum lifetime is reached, when block.timestamp - self.timestamp == marketOrderMinLifetime. This is inconsistent with the intended behavior of allowing an order to be modified or cancelled at the exact minimum lifetime.

Impact

Incorrect implementation of intended behavior.

Proof of Concept

1. A market order is placed at time T.

2. The marketOrderMinLifetime is set to 10 seconds.

3. At exactly T + 10 seconds, a request to modify or cancel the order is made.

4. The checkPendingOrder() function block the modification.

Recommendations

To fix this issue, modify the condition in the checkPendingOrder() function to use a strict inequality: