OrderBook

Description

The buyOrder() function do the following operations:

1. Transfers USDC from buyer to protocol and seller

2. Transfers the sold token to the buyer

These are multiple external token transfers that interact with untrusted user-controlled addresses, but the function lacks a nonReentrant modifier.

Risk

Likelihood:

• Reentrancy may be triggered by a malicious token contract using a receive() or fallback() function.

• This would happen during token transfers, especially if the state is updated after or during external calls.

Impact:

• Double-purchase of the same order

• Theft of funds via recursive execution

• Inconsistent state in orders or orderFills mappings

Proof of Concept

• MaliciousToken simulates a malicious actor. It initiates the attack by calling buyOrder().

  During the external call (like token transfer), the fallback function is triggered. The fallback re-calls buyOrder() recursively before the first call finalizes. Without nonReentrant, this can exploit state inconsistencies or double spending.

Recommended Mitigation

• Add a reentrancy guard modifier to key functions like buyOrder.

  // Add reentrancy protection

  bool internal locked;

  ​

  modifier nonReentrant() {

  require(!locked, "Reentrant call");

  locked = true;

  _;

  locked = false;

  }

  ​
  
  

  Apply the modifier to functions like:

  function buyOrder(...) external nonReentrant { ... }

Or you might import and apply ReentrancyGuard from OpenZeppelin