Skip to content

Latest commit

 

History

History
49 lines (33 loc) · 1.4 KB

020.md

File metadata and controls

49 lines (33 loc) · 1.4 KB

Tame Foggy Pony

High

Order ID generation allows for order overwriting

Summary

No response

Root Cause

The order ID generation is done as follows:

function generateOrderId(address sender) external view override returns (uint96) {
        uint256 hashedValue = uint256(keccak256(abi.encodePacked(sender, block.timestamp)));
        return uint96(hashedValue);
    }

This means that when sender batches 2 transactions, they will both have the same ID due to the same sender and same block.timestamp.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. Bob has a hanging approval for StopLimit
  2. Alice creates an order setting Bob as recipient which transfers his token into the contract:
tokenIn.safeTransferFrom(recipient, address(this), amountIn);
  1. Alice creates a 2nd order for Bob, this time for a small amount of tokens, batching both in the same transaction
  2. Bob can not cancel his first order as it was overwritten

It can also happen accidentally by Bob creating 2 transactions and the first one being overwritten. This results in stuck funds for Bob. Note that this is not a user error as he did nothing wrong and used the system as intended.

Impact

Bob will have stuck funds that he can not claim

PoC

No response

Mitigation

Change the ID generation or check that this is indeed a unique ID