OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Order Book DoS via Dust Order Spam

ksiddharth346

Description

The OrderBook contract allows users to create sell orders with arbitrary amounts. In this PoC, a user (bob) creates 100 sell orders, each selling only 1 wei of WETH for 1 USDC, with a deadline of 1 second. These "dust" orders clog the orderbook with essentially unusable trades.

Risk

Likelihood:

  • High – Any user can create such spam orders unless restricted. There’s no minimum order size or fee deterrent.

Impact:

  • Storage bloat, degraded user experience, and potential DoS in matching systems (if they iterate through spam orders).

Proof of Concept

This PoC shows how a user (Bob) can spam the OrderBook by creating 100 tiny sell orders, each selling just 1 wei of WETH for 1 USDC. These orders are created using a loop and are valid but economically meaningless.

Since there’s no minimum trade size, Bob can cheaply fill the orderbook with junk orders, potentially overwhelming the system, slowing down matching logic, or inflating storage/gas costs — a form of Denial-of-Service (DoS).

function test_spamOrders_DoS() public {
// Bob will spam 100 orders with 1 wei each
vm.startPrank(bob);
weth.approve(address(book), 100); // Approve enough for 100 orders
​
for (uint256 i = 0; i < 100; i++) {
// Each order: 0.1 WETH, 1 USDC, 1 second deadline
book.createSellOrder(address(weth), 1, 1, 1);
}
vm.stopPrank();
​
// Assert that 100 orders exist and are for 1 wei
for (uint256 i = 1; i <= 100; i++) {
(OrderBook.Order memory order) = book.getOrder(i);
assertEq(order.amountToSell, 1);
assertEq(order.priceInUSDC, 1);
assertEq(order.seller, bob);
}
}

Recommended Mitigation

  • Minimum Order Thresholds

  • Order Creation Fee / Bond

  • Order Expiry and Pruning

function createSellOrder(
address _tokenToSell,
uint256 _amountToSell,
uint256 _priceInUSDC,
uint256 _deadlineDuration
) public returns (uint256) {
+ require(_tokenTosell > 0 , "invalid token amount");
+ require(_tokenTosell >= MIN_ORDER_AMOUNT , "invalid amount");
if (!allowedSellToken[_tokenToSell]) revert InvalidToken(); //token whitelist check
if (_amountToSell == 0) revert InvalidAmount();
if (_priceInUSDC == 0) revert InvalidPrice();
if (_deadlineDuration == 0 || _deadlineDuration > MAX_DEADLINE_DURATION)
revert InvalidDeadline();
//------------ code ----------------------//
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 7 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.