OrderBook

First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Impact: high
Likelihood: medium
Invalid

Expired Orders Can Be Filled – Deadline Check Missing in fillOrder()

Root + Impact

Description


Normal Behavior

The contract allows sellers to list orders with a deadline. If the deadline passes, the order should no longer be fillable and sellers should be able to cancel and reclaim their tokens.

Specific Issue

The fillOrder() function does not verify whether the current timestamp is within the valid order window. This allows buyers to fill orders even after expiration, which contradicts the seller’s intent and bypasses deadline enforcement.


function fillOrder(uint256 orderId) external {
Order memory order = orders[orderId];
// ❌ No check for expiration
...
}

Risk

Likelihood:

  • High – the lack of a timestamp check makes all expired orders vulnerable under normal use conditions.

Impact:

  • Violates seller expectations and protocol design

  • Enables stale trades, which can cause financial loss

  • Undermines trust and fairness in peer-to-peer trading

Proof of Concept


This Foundry test simulates a buyer filling an order after the deadline has passed—violating the seller’s expectations and revealing a missing expiration check in fillOrder().

function testFillExpiredOrderShouldFail() public {
// 1. Setup: Seller creates an order with a short deadline
uint256 amount = 1000e18;
uint256 priceInUSDC = 500e6;
uint256 shortDeadline = block.timestamp + 1;
vm.prank(seller);
orderBook.createOrder(tokenA, amount, priceInUSDC, shortDeadline);
// 2. Fast-forward to after expiration
vm.warp(shortDeadline + 1);
// 3. Buyer attempts to fill the expired order
vm.prank(buyer);
vm.expectRevert("Order expired");
orderBook.fillOrder(0); // assuming orderId is 0
}

Recommended Mitigation

To prevent expired orders from being filled, enforce a timestamp check directly within fillOrder() to validate order freshness.

function fillOrder(uint256 orderId) external {
+ require(block.timestamp <= orders[orderId].deadline, "Order expired");
...
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.