Summary

Users can have orders filled at unfavorable prices if the sequencer goes offline due to missing deadlines in market orders.

Vulnerability Details

Market orders don't have a deadline, which is fine under normal conditions: they can't be front-run based on mempool information since Arbitrum does not have one and the sequencer is working so the user can just call cancelMarketOrder to prevent the market order to be filled.

But the problem with this implementation is the sequencer is not 100% reliable, meaning that a users could place an order at a given hour and still have the order pending at a later date without being able to cancel if the sequencer goes offline. The keeper could fill the user order before the user tentative to cancel go through when the sequencer gets back online.

Example:

1. Alice places a long position.

2. The sequencer has an issue and goes offline.

3. Alice cannot cancel the order when the sequencer is offline.

4. An hour later, market conditions change and the sequencer comes back online.

5. The keeper bot fills the order.

6. Alice tries to cancel the order but fails as it already got filled.

If Alice had a deadline set on her market order it would have prevented her order to be filled.

Impact

Users can have orders filled at unfavorable prices if the sequencer goes offline.

Tool used

Manual Review.

Recommendations

I recommend adding and checking a deadline for market orders.