Summary

When creating an order, there is a check done using the checkPendingOrderfunction. This check is to ensure that the order has existed for the minimum order lifetime.

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/OrderBranch.sol#L349

This prevents recently updated orders from entering the market. But there is no check for this when filling an order that was recently created.

The lack of this check results in the following vulnerability:

• Recently created orders will enter the market without reaching the criteria for the marketOrderMinLifetimeonce their pass on the fillOrder.

Impact

• Loss of Funds: recently created orders will change skew/OI and be filled before updated orders.

• Unfairness: recently created orders can be filled before the checkPendingOrdervalidation.

Tools Used

Manual Review

Recommendations

Add the marketOrder.checkPendingOrder()for the _fillOrderfunction. This will ensure that all filled orders have met the minimum market order lifetime.