Submission Details
Impact:
Likelihood:
Order Expiry Lock (Denial of Funds)
Description
Problem
If a seller forgets or is unable to cancel an expired order, their tokens are locked forever.
Chained Risk:
If the seller is a contract that is later destroyed or blacklisted, tokens can never be withdrawn.
// Only the seller can cancel an expired order
function cancelSellOrder(uint256 _orderId) public {
Order storage order = orders[_orderId];
if (order.seller != msg.sender) revert NotOrderSeller();
// ...
}
Risk
Likelihood:
-
Reason 1 // Describe WHEN this will occur (avoid using "if" statements)
-
Reason 2
Impact:
-
Impact 1
-
Impact 2
Proof of Concept
Recommended Mitigation
- if (order.seller != msg.sender) revert NotOrderSeller();
+ if (order.seller != msg.sender && block.timestamp < order.deadlineTimestamp) revert NotOrderSeller();
Updates
Rewards breakdown
nSLOC
217This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.