OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Price manipulation in `amendSellOrder` allows front-running scenario

0xkatrix

Root + Impact

Description

  • Seller can front-run the buyer and call OrderBook::amendSellOrder to increase the priceInUSDC value to a high enough value in order to drain the buyer's entire holdings of USDC

// Update order details
order.amountToSell = _newAmountToSell;
@> order.priceInUSDC = _newPriceInUSDC;
order.deadlineTimestamp = newDeadlineTimestamp;

Risk

Likelihood: High

  • Reason 1 Whenever buyer calls buyOrder, seller can front-run to execute this exploit

Impact: Buyer can easily lose their entire holdings of USDC

Proof of Concept

  • Seller places an order to sell 1wBTC for 107,000USDC

  • Buyer calls buyOrder, assuming he's going to get 1wBTC

  • Seller front-runs and calls amendSellOrder, increases the priceInUSDC to the balance amount of the buyer's address, assuming unlimited approval

  • Seller ends up draining the seller's USDC balance completely

Recommended Mitigation

Do not allow price manipulation in amendSellOrder

Updates

Lead Judging Commences

yeahchibyke Lead Judge
10 months ago
yeahchibyke Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!