Pieces Protocol

Summary

The buyOrder function in the TokenDivider.sol contract does not validate the orderIndex parameter to ensure it is within the bounds of the s_userToSellOrders[seller] array. This can lead to an out-of-bounds array access,

Vulnerability Details

The buyOrder function does not currently check if the orderIndex is within the valid range of the s_userToSellOrders[seller] array. If an invalid orderIndex is provided, it could lead to an out-of-bounds array access, causing the function to revert unexpectedly.

Impact

An attacker can exploit the lack of bounds checking on the orderIndex parameter in the buyOrder function to cause a denial-of-service (DoS) attack on the contract. Here's how:

1. Invalid orderIndex: By providing an orderIndex that is out of bounds (i.e., greater than or equal to the length of the s_userToSellOrders[seller] array), the attacker can cause the function to revert. This is because accessing an invalid index in the array will cause a runtime error.

2. Repeated Reverts: The attacker can repeatedly call the buyOrder function with an invalid orderIndex, causing the function to revert each time. This can prevent legitimate users from successfully executing the buyOrder function, effectively causing a denial-of-service.

POC

By setting my orderIndex to a very high value of 9000000000000000000000000 the transaction reverted to the initial state

Tools used:

remix ide

Recommendation:

Add a check to ensure that the orderIndex is within the bounds of the s_userToSellOrders[seller] array before accessing it. Here is an example of how to add this check: