Under normal behavior, a buyer interacts with an active sell order by calling buyOrder()
, expecting that the terms (price, amount, availability) remain constant during transaction processing.
However, due to the public and delayed nature of blockchain transactions, sellers can monitor the mempool and front-run buyers by cancelling or amending their order before the buyer’s transaction is mined — effectively voiding or altering the trade.
This leads to:
Failed buyOrder()
transactions (wasting gas)
Broken trust in order execution
Potential manipulation of pricing and availability
Likelihood:
This issue arises specifically during the window when a buyer's transaction is pending in the mempool, especially on congested chains like Ethereum Mainnet or in low-GWEI environments.
Sophisticated or malicious sellers (or bots) can use tools to monitor pending transactions and react accordingly.
In protocols without a relayer or off-chain matching, this is more likely.
Impact:
Buyers waste gas on failed buyOrder()
calls.
Seller can manipulate the trade price or availability last-minute.
Trust in the trading experience is broken, harming protocol reputation and UX.
Malicious actors can automate this behavior to grief or manipulate markets.
This can also occur with amendSellOrder()
if the seller raises the price just before the buy.
This the the changes for the whole codebase, refer this link
https://github.com/CodeHawks-Contests/2025-07-orderbook/commit/78f5ea5709d7dd243cb7de292405cca46d627743
Introduce a time-based buy lock in the Order
struct, and enforce it across key order-modifying functions to prevent sellers from front-running buyers.
Order
StructAdd a buyLockExpiresAt
timestamp to manage temporary locks during a buy attempt:
lockOrderForBuy()
FunctionThis is used by the frontend, bot, or relayer before calling buyOrder()
:
BUY_LOCKIN_PERIOD
can be defined as a constant, e.g., 10 minutes
.
cancelSellOrder()
to Prevent Cancellation During LockamendSellOrder()
to Prevent Changes During LockbuyOrder()
To prevent stale locks:
This ensures:
Buyers can reserve a fair 10-minute window to submit their transaction
Sellers cannot grief, amend, or cancel an order mid-buy
The lock naturally expires if the buyer doesn’t follow through
Simplicity: only one variable needed (buyLockExpiresAt
)
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.