Virtual Indigo Shetland - orderid in StopLimit will overwrite order in bracket

[sherlock-admin2]

Virtual Indigo Shetland

High

orderid in StopLimit will overwrite order in bracket

Summary

The same orderId can be used across StopLimit and Bracket contracts, enabling a user to create conflicting orders in both contracts at the same timestamp. This results in one order overwriting the other, leading to potential manipulation and double-spending exploits.

Root Cause

The generateOrderId function uses only msg.sender and block.timestamp to generate orderId. Since there is no check to verify if an orderId already exists in Bracket, orders created at the same timestamp in both contracts collide.

Internal pre-conditions

• generateOrderId is called at the same timestamp for orders in both StopLimit and Bracket.

External pre-conditions

• A user creates orders on StopLimit and Bracket at the same block.timestamp.

Attack Path

1. The user creates two orders simultaneously:
   • A small order in Bracket.
   • A larger order in StopLimit.
2. Both orders are assigned the same orderId due to identical msg.sender and block.timestamp.
3. When the StopLimit order is filled, it overwrites the Bracket order with its new data.
4. The user can then:
   • Cancel or execute both orders, effectively doubling the value of the manipulated order.
   • Exploit overwritten order data to reclaim funds or execute unintended orders.

Impact

• Loss of funds for the protocol due to overwritten orders and unauthorized manipulation.

PoC

No response

Mitigation

Check for Existing orderId
Before creating a new order, verify whether the orderId already exists in the contract