Submission Details
Impact:
Likelihood:
Token Symbol May Be Empty in Order Details String
# Token Symbol May Be Empty in Order Details String
## Description
The function `getOrderDetailsString` relies on hardcoded token address checks to determine the symbol. If a future token is allowed via `setAllowedSellToken()`, the `tokenSymbol` will remain uninitialized and empty in the UI.
```solidity
// @> tokenSymbol unassigned for unknown tokens
string memory tokenSymbol;
if (order.tokenToSell == address(iWETH)) {
tokenSymbol = "wETH";
} else if (order.tokenToSell == address(iWBTC)) {
tokenSymbol = "wBTC";
} else if (order.tokenToSell == address(iWSOL)) {
tokenSymbol = "wSOL";
}
```
## Risk
**Likelihood**:
* Occurs when admin adds new token via `setAllowedSellToken`.
* UI presents order details for non core tokens.
**Impact**:
* `getOrderDetailsString` will display no token symbol.
* UI looks broken or confusing.
## Proof of Concept
The function `getOrderDetailsString()` uses hardcoded token address comparisons to set the token symbol (wETH, wBTC, wSOL). If a **new token is added via `setAllowedSellToken()`**, its symbol will be blank in the string output.
```solidity
// Assume `newToken` is a valid ERC20 token (e.g., wDOGE) with 18 decimals
orderBook.setAllowedSellToken(address(newToken), true);
// Create sell order using the new token
orderBook.createSellOrder(
address(newToken),
1e18,
100e6,
3600
);
// View order string details
string memory details = orderBook.getOrderDetailsString(1);
```
### Output will contain:
```
Selling: 1000000000000000000
```
- Notice the **missing token symbol**, which should be `"wDOGE"` or something meaningful.
## Recommended Mitigation
Introduce `mapping(address => string) public tokenSymbols` and update it during token registration.
```diff
- string memory tokenSymbol;
+ string memory tokenSymbol = tokenSymbols[order.tokenToSell];
```
Rewards breakdown
nSLOC
217This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.