Root + Impact

Description

The cancelSellOrder function does not enforce the documented behavior:

If the order isn't filled before the deadline, sellers can cancel and retrieve their tokens.

Currently, the function allows sellers to cancel their orders after the deadline has passed. However, based on the intended logic, cancellation should only be allowed before the deadline.

Expected Behavior

• Sellers should be allowed to cancel their orders before the deadline (if the order is still active).

• After the deadline has passed, the seller should no longer be able to cancel the order.
  
  Risk

Likelihood:

• This issue will occur every time a seller tries to cancel an expired order.

• There's no restriction stopping them from doing so.

Impact:

• Breaks time-based control over the order book.

• Invalidates expiration logic, allowing orders to be removed outside their window.

• Could lead to unfair behavior, where sellers pull out of committed offers even after the deadline has passed.

Proof of Concept

Recommended Mitigation

Add a condition to prevent cancellation after the deadline: