OrderBook::getOrderDetailsString
function does not make a call to the token contract in order to get a symbol for non-core tokens, resulting in token symbol not showing in the order detailsDescription: The OrderBook::getOrderDetailsString
function checks order.tokenToSell
to determine the token symbol.
However, this only works for core tokens (wETH, wBTC and wSOL). For any other token tokenSymbol
stays blank.
Impact:
As a result, potential buyers are not able to see which token is being sold by looking at the order details (unless the token is wETH, wBTC or wSOL). This will discourage potential buyers from purchasing tokens.
Proof of Concept:
Create a TestToken.sol
file in /test/mocks
with the following code:
Add the following code to test/TestOrderBook.t.sol
:
Run forge test --mt test_tokenSymbolIsBlank -vvv
command.
Observe that the order details string does not contain the token symbol.
Recommended Mitigation:
Add staticcall to get symbol from the token contract.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.