Part 2

Summary

An attacker could exploit the order fee calculation to

Impact

1. Avoid paying fee

2. Trigger unnecessary fee charge by raipidly opening/closing orders

Vulnerability Details

This vulnerability occurs since the order fee calculation and deduction process allows attackers to

1. Avoid paying fee:

• If fees are calculated before trade validation but not deducted upfront, a malicious trader could bypass the fee payment mechanism while still executing the trades.

1. Exploit fee refunds or cancellation:

• the system charges fee but allows free cancellations, an attacker could rapidly open and cancel orders to drain protocol funds or inflate trading activity artificially.

1. Manipulate fee calculations for tiny orders:

• If fees are too low for small trades a trader could abuse micro-orders to spam the system with minimal cost.

• This creates unnecessary computational overhead and potential DoS risks for the platform.

  PoC

  Scenario:

• Alice submits an order, and the systems calculated but does not charge fees immediately

• Before execution, Alice cancels the order, avoiding the fee entirely.

• Alice can spam thousand of orders and cancels them abusing free order placements

• This inflates fake trading activity while never actually paying any fees.

Micro Order Spam

If there is no minimum fee enforcement
Malicious trader can:
Place thousands of tiny trades (e.g., $0.01 trades )
Exploit near-zero fees to flood the system with orders
Slow down the contract (Dos attack) without meaningful cost.

Tools Used

Manual Review

Recommendations

Charge fees upfront

Enforce a minimum Fee