OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Price manipulation in `amendSellOrder` allows front-running scenario

0xkatrix

Root + Impact

Description

  • Seller can front-run the buyer and call OrderBook::amendSellOrder to increase the priceInUSDC value to a high enough value in order to drain the buyer's entire holdings of USDC

// Update order details
order.amountToSell = _newAmountToSell;
@> order.priceInUSDC = _newPriceInUSDC;
order.deadlineTimestamp = newDeadlineTimestamp;

Risk

Likelihood: High

  • Reason 1 Whenever buyer calls buyOrder, seller can front-run to execute this exploit

Impact: Buyer can easily lose their entire holdings of USDC

Proof of Concept

  • Seller places an order to sell 1wBTC for 107,000USDC

  • Buyer calls buyOrder, assuming he's going to get 1wBTC

  • Seller front-runs and calls amendSellOrder, increases the priceInUSDC to the balance amount of the buyer's address, assuming unlimited approval

  • Seller ends up draining the seller's USDC balance completely

Recommended Mitigation

Do not allow price manipulation in amendSellOrder

Updates

Lead Judging Commences

yeahchibyke Lead Judge
about 2 months ago
yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.