Root Cause

The getOrderDetailsString(uint256 _orderId) function only maps token addresses to symbols using static conditional logic:

This logic does not scale to support tokens added dynamically via setAllowedSellToken().

Description

The getOrderDetailsString(uint256 _orderId) function fails to display token symbols for tokens dynamically added via setAllowedSellToken(). This is due to the use of hardcoded token address checks, which only recognize three specific tokens (iWETH, iWBTC, and iWSOL). All other tokens will display an empty token symbol, making the returned order details incomplete or misleading.

Risk

Likelihood: High

Severity: Low

Impact:

• Sell orders for dynamically added tokens will return empty "Selling" fields.

• Users or interfaces relying on getOrderDetailsString() will not know which token is involved.

Recommended Mitigation

Use IERC20Metadata.symbol()

Fetch the symbol dynamically from the token contract:

Note: Ensure the token contract implements symbol() (standard for most ERC-20 tokens).

Alternative Fix: Store symbol on setAllowedSellToken

Modify the allowlist function to store symbols:

Then access it in getOrderDetailsString: