OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Amount manipulation in `amendSellOrder` allows front-running scenario

0xkatrix

Root + Impact

Description

  • Seller can front-run the buyer and call OrderBook::amendSellOrder to reduce the amountToSell value to 1 wei, which tends to zero and end up keeping their original assets while also making the user pay for the original amount of tokens.

  • Seller makes ~100% profit while buyer loses ~100% of value

function amendSellOrder(
uint256 _orderId,
uint256 _newAmountToSell,
uint256 _newPriceInUSDC,
uint256 _newDeadlineDuration
) public {
Order storage order = orders[_orderId];
​
// Validation checks
if (order.seller == address(0)) revert OrderNotFound(); // Check if order exists
if (order.seller != msg.sender) revert NotOrderSeller();
if (!order.isActive) revert OrderAlreadyInactive();
if (block.timestamp >= order.deadlineTimestamp) revert OrderExpired(); // Cannot amend expired order
if (_newAmountToSell == 0) revert InvalidAmount();
if (_newPriceInUSDC == 0) revert InvalidPrice();
if (_newDeadlineDuration == 0 || _newDeadlineDuration > MAX_DEADLINE_DURATION) revert InvalidDeadline();
​
uint256 newDeadlineTimestamp = block.timestamp + _newDeadlineDuration;
IERC20 token = IERC20(order.tokenToSell);
​
// Handle token amount changes
if (_newAmountToSell > order.amountToSell) {
// Increasing amount: Transfer additional tokens from seller
uint256 diff = _newAmountToSell - order.amountToSell;
token.safeTransferFrom(msg.sender, address(this), diff);
@> } else if (_newAmountToSell < order.amountToSell) {
@> // Decreasing amount: Transfer excess tokens back to seller
@> uint256 diff = order.amountToSell - _newAmountToSell;
@> token.safeTransfer(order.seller, diff);
}

Risk

Likelihood: High

  • Reason 1 Whenever buyer calls buyOrder, seller can front-run to execute this exploit

Impact: Buyer essentially loses 100% of the assets they were transferring without receiving the source asset's original amount

Proof of Concept

  • Seller places an order to sell 1wBTC for 107,000USDC

  • Buyer calls buyOrder, assuming he's going to get 1wBTC

  • Seller front-runs and calls amendSellOrder, reduces the amountToSell to 1 wei of wBTC

  • Seller ends up keeping almost 1wBTC and receives 107,000USDC

  • Buyer loses 107,000USDC for negligible amount of wBTC

Recommended Mitigation

Do not allow amount manipulation in amendSellOrder

Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Buy orders can be front-run and amended maliciously

A malicious seller can front-run a buy order for their order, and decrease the amount of assets to be sold. If the price is unchanged, the buy transaction fulfills, but the buyer gets lesser amount than expected.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.