Submission Details
Impact:
Likelihood:
`OrderBook::setAllowedSellToken` Inconsistent Token Control Implementation Enables Market Manipulation
Root + Impact
Description
The `setAllowedSellToken` function creates inconsistent behavior across contract functions by only affecting `createSellOrder` while leaving all other functions `(amendSellOrder, cancelSellOrder, buyOrder)` unchecked. This asymmetric implementation allows the owner to disable new order creation for a token while existing orders remain fully functional, creating an artificial market constraint that favors buyers over sellers.
// Root cause in the codebase with @> marks to highlight the relevant section
Risk
Likelihood:
-
Owner can disable tokens anytime as soon as a user create a sell order
Impact:
- Market Manipulation: Owner can artificially restrict supply of new sell orders while allowing existing orders to be executed, potentially manipulating token prices
- Centralization Risk: Introduces unnecessary admin control over market operations in the system, even though its TradFi but kind of control is unjustifiable.
- User Experience: Creates confusing behavior where some functions work while others fail with unclear error messages
- System Integrity: Breaks the principle of consistent behavior across related functions
Proof of Concept
// Owner disables wETH trading
setAllowedSellToken(address(wETH), false);
// This will fail - new orders blocked
createSellOrder(address(wETH), 1e18, 3000e6, 1 days); // reverts with InvalidToken
// But existing orders remain fully functional
amendSellOrder(existingOrderId, 2e18, 6000e6, 2 days); // works fine
cancelSellOrder(existingOrderId); // Works fine
buyOrder(existingOrderId); // Works fine
// Result: Artificial scarcity of new sell orders while existing ones can be manipulated
Recommended Mitigation
Remove the function entirely
- function setAllowedSellToken( address _token,bool _isAllowed) external onlyOwner {
- if (_token == address(0) || _token == address(iUSDC)) revert InvalidToken();
- allowedSellToken[_token] = _isAllowed;
- emit TokenAllowed(_token, _isAllowed); }
Rewards breakdown
nSLOC
217This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.