Submission Details
Severity:
Array out-of-bounds access
Relevant GitHub Links
Summary
The buyOrder() function doesn't have any mechanism to prevent a Dos attack and doesn't follow the Check-effects-interactions pattern
Vulnerability Details
No bounds check on orderIndex
No validation if seller has any orders
Could lead to out-of-bounds access or returning empty/invalid data
Impact
Potential array out-of-bounds access leading to DoS or contract revert
Tools Used
Manual review
Recommendations
add a check
require(s_userToSellOrders[seller].length > orderIndex, "Invalid order index");
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.