The buyOrder(uint256 _orderId) function lacks a mechanism for the buyer to specify acceptable trade terms, such as a minimum amount of tokens expected or a maximum price they're willing to pay.
This makes the function vulnerable to price mismatches or delays between order visibility (e.g., on a frontend or block explorer) and transaction execution. Since orders are matched and fulfilled purely based on order ID without user-side slippage bounds, buyers may unintentionally complete trades under worse-than-expected conditions.
Additionally, this lack of slippage protection exposes users to front-running MEV bots, who can snipe valuable orders from the mempool before legitimate users.
Likelihood:
This design pattern (no slippage/min expected amount check) is very common in simple DeFi contracts.
Many developers assume price/order terms are static or fixed, but:
Mempool latency
Delayed UI state
Miner reordering or MEV bots
all create scenarios where execution conditions change between user intent and transaction mining.
Front-running risk is already high on public chains (see Flashbots ecosystem).
Impact:
Honest users may overpay or receive fewer tokens than expected due to price shifts or stale UI data.
Users are vulnerable to MEV-style frontrunning attacks.
There's no way for buyers to protect themselves by reverting unfavorable trades.
Notice the absence of any checks like:
or
Add buyer-defined protection parameters to the buyOrder() function:
function buyOrder(uint256 _orderId, uint256 maxPriceInUSDC) external { ... }
Or:
function buyOrder(uint256 _orderId, uint256 minTokensOut) external { ... }
Include require() statements to ensure the order still meets the buyer’s terms:
require(order.priceInUSDC <= maxPriceInUSDC, "Slippage limit exceeded");
Encourage off-chain quoting (e.g., signed metadata) or batch execution for safer pricing.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
View preliminary resultsAppeals are being carefully reviewed by our judges.
The contest is complete and the rewards are being distributed.