Summary

Users can create sell ERC20 orders but there is no way to cancel an order without paying unexpected taxes.

Vulnerability Details

• A user can create sell orders in TokenDivider::sellErc20

• No one buys or a user wants to get back his ERC20 shared

• The user cannot cancel his order or modify his order and would have to buy his own order in ETH, thus paying the fee from TokenDivider::buyOrder

Impact

• Unexpected loss of fund, and friction

Recommendations

• Add a function for cancelling a sell order

• Authorize the seller to buy his own order with no tax