Submission Details
Impact:
Likelihood:
`cancelSellOrder` misses validation check
Root + Impact
Description
Seller should not be able to cancell their after the deadline.
// Root cause in the codebase with @> marks to highlight the relevant section
function cancelSellOrder(uint256 _orderId) public {
Order storage order = orders[_orderId];
// Validation checks
if (order.seller == address(0)) revert OrderNotFound();
if (order.seller != msg.sender) revert NotOrderSeller();
if (!order.isActive) revert OrderAlreadyInactive(); // Already inactive (filled or cancelled)
// Mark as inactive
order.isActive = false;
// Return locked tokens to the seller
IERC20(order.tokenToSell).safeTransfer(order.seller, order.amountToSell);
emit OrderCancelled(_orderId, order.seller);
}
Risk
Likelihood:
Seller can cancell their order after the deadline.
Impact:
-
Breaks protocol rules.
Proof of Concept
Recommended Mitigation
- remove this code
+ if (block.timestamp >= order.deadlineTimestamp) revert OrderExpired();
Updates
Rewards breakdown
nSLOC
217This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.