Root + Impact

Description

Normal Behavior:
The amendSellOrder() function allows sellers to update their order’s amount, price, and deadline. Each amendment resets the deadline to a new timestamp (block.timestamp + duration) provided it’s within the MAX_DEADLINE_DURATION of 3 days.

Specific Issue:
There is no restriction on total lifetime of an order. Sellers can continually call amendSellOrder() just before the order expires to extend the deadline indefinitely, keeping stale orders on-chain forever. This creates a denial-of-cleanup problem and allows the on-chain order book to be filled with near-permanent spam.

Risk

Likelihood:

This behavior occurs every time a seller chooses to keep extending their order, which is common in slow markets.

There is no built-in limit, cooldown, or lifetime cap, so repeated amendments are trivial and expected over long durations.

Impact:

Stale or low-quality orders can linger forever in the order book, impacting UX and indexing tools.

Attackers can spam orders that never expire, bloating the contract state and potentially increasing storage/gas costs over time.

Proof of Concept

This creates a pseudo-permanent order that never expires, defeating the purpose of a deadline system.

Recommended Mitigation

Additional changes