Submission Details
Severity:
Buyer can only query the price of orders, but cannot query the amount of fraction token in each order
Description:
In the getOrderPrice function, the contract returns only the price of the order,
not the actual amount of tokens being sold. Logically, buyers should be able to query the amount of tokens in each order.
function getOrderPrice(address seller, uint256 index) public view returns(uint256 price) {
price = s_userToSellOrders[seller][index].price;
}
Impact:
non-transparent to buyers, they cannot know the actual amount of tokens they will get after buying an order.
Recommended Mitigation:
return the full struct of the order instead of only the price
- function getOrderPrice(address seller, uint256 index) public view returns(uint256 price) {
- price = s_userToSellOrders[seller][index].price;
- }
+ function getOrderPrice(address seller, uint256 index) public view returns(SellOrder memory) {
+ return s_userToSellOrders[seller][index];
+ }
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.