Race Condition Between Cancellation and Purchase
Description: Because cancelSellOrder and buyOrder are separate transactions, a miner or frontrunning bot can reorder them. A buyer's buyOrder may execute just before a seller’s cancelSellOrder, resulting in stale cancellations or unwanted fills.
Impact:
– Legitimate buyers can lose out when their purchase is front-run by a cancellation, and sellers can unexpectedly lose their order to a near-simultaneous buy.
– This undermines user trust and can lead to lost funds or failed trades.
Mitigation:
– Introduce a short "grace period" before cancelSellOrder takes effect (e.g. two-step cancel: request + execute after delay).
– Alternatively, employ a commit–reveal or time-lock pattern to serialize intent.
Lead Judging Commences
Amends or cancellation of sell orders can be front-run
When a seller wants to amend or cancel their sell orders, a malicious entity can front-run their transactions and buy out the orders. This can be especially harmful when real-world prices of listed assets fluctuate and sellers want to adjust the prices listed in their orders.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.