OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Actual implementation does not account for order.deadline being equal to block.timestamp

vceb

Some functions in the codebase do not account for the case when order.deadlineTimestamp is equal to block.timestamp and will revert in this case

Description

In OrderBook::buyOrder or OrderBook::amendSellOrder functions, it is verified that users are unable to call them if the order has expired, but it also reverts when order.deadlineTimestamp is equal to block.timestamp, but it should accept this case

@> if (block.timestamp >= order.deadlineTimestamp) revert OrderExpired();

Risk

Likelihood:

This bug will take place every time a user tries to call OrderBook::buyOrder or OrderBook::amendSellOrder when order.deadlineTimestamp is equal to block.timestamp
Impact:
OrderBook::buyOrder and OrderBook::amendSellOrder will revert when called under these conditions, and the seller will not be able to amend his/her order or user will be unable to buy an Order

Proof of Concept

The following PoC shows that a user is unable to call OrderBook::amendSellOrder when block.timestamp is equal to order.deadlineTimestamp

function testAmend() public {
vm.startPrank(clara);
wsol.approve(address(book), 2e18);
uint256 claraId = book.createSellOrder(
address(wsol),
2e18,
300e6,
2 days
);
vm.warp(2 days + 1);
vm.expectRevert(OrderBook.OrderExpired.selector);
book.amendSellOrder(claraId,1e18,300e6,2 days);
vm.stopPrank();
}

Recommended Mitigation

Consider removing the >= to accept the block.timestamp in the order.deadlineTimestamp range

- if (block.timestamp >= order.deadlineTimestamp) revert OrderExpired();
+ if (block.timestamp > order.deadlineTimestamp) revert OrderExpired();
Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.