OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

### [M-2] Frontrunning attack via ```amendSellOrder``` Function Before Buyer Transaction confirmation

wolf_kalp

[M-2] Frontrunning attack via amendSellOrder Function Before Buyer Transaction confirmation

Description

The OrderBook::amendSellOrder function allows sellers to update their price ,amount and deadline.
Since Ethereum mempool is public, A malicoius seller can monitor pending buyorder transaction and frontrun
them by modifying (increasing price and reducing token),causing buyers to receive less token then expected
and paying more price.

Impact:

1.Buyer tricked into accepeting ammended orders with worse terms

2.loss of buyers trust in the protcol due to unexpected situations

3.If price or amount changes before mining, even trusted frontend UIs become unreliable.

Proof of Concept

​
1.Seller lists 100 wETH for 1000 USDC.
​
2.Buyer sees this and calls buyOrder(orderId) paying 1000 USDC.
​
3.Buyer’s transaction is pending in the mempool.
​
4.Seller quickly frontruns it with amendSellOrder() changing amount to 50 wETH or price to 2000 USDC.
​
5.Depending on timing, buyer:
​
Gets fewer tokens than expected.
​
Or transaction fails (deadline or price mismatch on frontend vs blockchain).
​
6.This all happens on-chain and undetectable pre-transaction, resulting in buyer exploitation.
​

Recommended Mitigation

1.Add order hash commitment to ensure no changes were made

2.Buyers compute the hash off-chain before sending the transaction.

function buyOrder(uint256 _orderId, bytes32 expectedHash) public {
require(
keccak256(abi.encode(order.amountToSell, order.priceInUSDC, order.deadlineTimestamp)) == expectedHash,
"Order modified"
);
}
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge
4 months ago
yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

wolf_kalp Submitter
4 months ago
yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Buy orders can be front-run and amended maliciously

A malicious seller can front-run a buy order for their order, and decrease the amount of assets to be sold. If the price is unchanged, the buy transaction fulfills, but the buyer gets lesser amount than expected.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.