Root + Impact

This vulnerability affects the buyOrder function, which handles the purchase of existing sell orders. The function allows any user, including the seller themselves, to execute a buy action. Without a restriction, the seller can buy their own order, which should not be permitted as it bypasses intended marketplace logic.

Allowing sellers to buy their own orders can lead to several negative consequences:

• Market manipulation: Sellers might artificially inflate trade volume or manipulate price data.

• Incorrect fee accounting: The protocol fee and seller payments may be incorrectly processed, potentially causing financial discrepancies.

• Unexpected state changes: The contract’s order lifecycle may behave unexpectedly, causing inconsistencies or exploit opportunities.

Description

• The buyOrder function currently lacks a check to prevent a seller from buying their own sell order. This can lead to unintended consequences such as circular token transfers, incorrect fee calculations, or potential manipulation of order states. Adding a validation to disallow sellers from purchasing their own orders will improve contract integrity and prevent misuse.

Risk

Likelihood:

• A seller might accidentally or maliciously attempt to buy their own sell order.

• Without this check, such action is possible and could cause unintended behavior in the contract.

Impact:

• Buying one’s own order could lead to data inconsistencies (e.g., incorrect fee handling or token accounting).

• It may waste gas and tokens without meaningful outcome.

Proof of Concept

Recommended Mitigation