OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

Missing ERC20 interface check in OrderBook_setAllowedSellToken function

tanug

Missing interface check in OrderBook::setAllowedSellToken function could permit non-ERC20 tokens leading to complete DOS for affected token operation.

Description

  • If an owner maliciously or accidentally sets a non-ERC20 contract address as allowed token, users may attempt to create sell orders with this token and the IERC20::safeTransferFrom call in OrderBook::createSellOrder will always fail because the address doesn't implement ERC20 interface.

  • No conditional check added to ensure the erc20 compatibility of new token addresses.

// Root cause in the codebase with @> marks to highlight the relevant section
function setAllowedSellToken(address _token, bool _isAllowed) external onlyOwner {
if (_token == address(0) || _token == address(iUSDC)) revert InvalidToken(); // Cannot allow null or USDC itself
@> allowedSellToken[_token] = _isAllowed;
​
emit TokenAllowed(_token, _isAllowed);
}

Risk

Likelihood:

  • When an owner maliciously or accidentally sets a non-ERC20 contract address as allowed token.

Impact:

  • This can create a permanent denial-of-service (DOS) attack where users lose gas and cannot create orders with that token.

Proof of Concept

This shows a random address being successfully set as token address.

function test_Allow_Random_Address_As_Token_Address() external {
vm.prank(owner);
vm.expectEmit();
//using a random non-erc20 address - address(1)
emit OrderBook.TokenAllowed(address(1), true);
book.setAllowedSellToken(address(1), true);
}

Recommended Mitigation

Validating ERC20 compliance before modifying the storage variable

​
+ // Validate ERC20 compliance
+ if (_isAllowed) {
+ try IERC20(_token).totalSupply() returns (uint256) {
+ // Token implements ERC20 interface
+ } catch {
+ revert InvalidToken(); // Not a valid ERC20 token
+ }
+ }
+
+ allowedSellToken[_token] = _isAllowed;
Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.