Summary

Anyone can monitor the buyOrder transactions and place their own order with the same details or even a lower msg.value, but with a higher gas price, to ensure their transaction gets mined first. This allows the attacker to front-run the legitimate buyer, becoming the purchaser of the token instead. As a result, the intended buyer loses the opportunity to acquire the token, and the attacker gains unfair access to it.

Impact

The attacker can buy a specific token before the legitimate buyer's transaction is processed, effectively stealing the opportunity to purchase the asset. This not only causes financial loss for the buyer but also undermines the fairness and reliability of the platform.

Tools Used

• Manual review.

Recommendations

• You can consider implementing a two-step process where people interested in buying a specific token first have to join a 'waitlist' with their offer, and the seller has to choose which offer to accept.

• Also you can think of using a private mempool