Description:

The OrderBook contract is vulnerable to front-running attacks when sellers attempt to increase their order prices through the amendSellOrder() function. The vulnerability stems from the lack of atomic price updates and the public visibility of pending transactions in the mempool. When a seller submits a transaction to increase their order price (e.g., due to favorable market conditions), MEV bots can observe this transaction and immediately purchase the order at the old, lower price before the amendment is processed.

The attack exploits the time gap between transaction submission and execution, allowing malicious actors to extract value from sellers who are trying to adjust their prices to current market conditions.

Attack path:

1. Order creation: Seller creates an order selling 1 WETH for 3,000 USDC

2. Market movement: WETH price increases to $3,500 on external markets

3. Amendment attempt: Seller submits amendSellOrder(orderId, 1e18, 3500e6, 2 days) with 30 gwei gas

4. MEV detection: Bot monitors mempool and detects the price increase transaction

5. Front-running: Bot submits buyOrder(orderId) with higher gas price (100 gwei)

6. Block execution: Bot's transaction executes first, purchasing WETH at old price (3,000 USDC)

7. Amendment failure: Seller's amendment transaction reverts with "OrderNotActive" error

8. Profit extraction: Bot sells WETH at market price (3,500 USDC) for 500 USDC profit

Impact:

Sellers lose potential profits when trying to adjust prices to market conditions (in the example, $500 loss per 1 WETH)

Bots capture value intended for legitimate sellers without providing any service

Users become reluctant to create orders knowing they cannot effectively adjust prices

The vulnerability is particularly severe during high volatility periods when price adjustments are most needed, potentially causing significant financial losses for users.

Recommended Mitigation:

Implement a system requiring the seller to confirm they genuinely want to sell at the specified price after a buyer expresses interest