Submission Details
Impact:
Likelihood:
There is no function by which seller can withdraw token after order.deadlineTimestamp becomes greater than block.timestamp
Root + Impact
Problem in the contract OrderBook.sol
Description
No function written to withdraw funds after order.deadlineTimestamp becomes greater than block.timestamp in the contract OrderBook.sol
Risk
Likelihood:
-
When seller list their tokens , the buyer get to buy those token via smart contract OrderBook.sol before the order.deadlineTimestamp becomes greater than block.timestamp
-
When order.deadlineTimestamp > block.timestamp then buyers can't buy token hence seller can withdraw their token but there is no way to do so
Impact:
Impact 1 : loss of tokens
Proof of Concept
function test_withdrawFundsAfterDeadline() public {
// alice creates sell order for wbtc
vm.startPrank(alice);
wbtc.approve(address(book), 2e8);
uint256 aliceId = book.createSellOrder(address(wbtc), 2e8, 180000e6, 2 days);
vm.stopPrank();
// Move time forward by 3 days to ensure all orders are expired
vm.warp(block.timestamp + 3 days);
// dan tries to buy orders but they are expired
vm.startPrank(dan);
usdc.approve(address(book), 200000e6);
// dan tries to buy alice's order but it is expired
try book.buyOrder(aliceId) {
assert(false);
} catch {}
vm.stopPrank();
// alice withdraws his expired order
vm.prank(alice);
book.withdrawFundsAfterDeadline(aliceId);
}
Recommended Mitigation
// new function created
error OrderNotExpired(); // added in the error section
function withdrawFundsAfterDeadline(uint256 _orderId) external {
Order storage order = orders[_orderId]; // retrieving order data
// Validation checks
if (order.seller == address(0)) revert OrderNotFound();
if (order.seller != msg.sender) revert NotOrderSeller();
if (!order.isActive) revert OrderNotActive(); // Cannot withdraw if order is still active
if (block.timestamp < order.deadlineTimestamp) revert OrderNotExpired(); // Cannot withdraw before deadline
order.isActive = false;
// Transfer the tokens back to the seller
IERC20(order.tokenToSell).safeTransfer(order.seller, order.amountToSell); // sending token back to owner
}
Updates
Rewards breakdown
nSLOC
217This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.