Putty contest - saneryee's results

An order-book based american options market for NFTs and ERC20s.

General Information

Platform: Code4rena

Start Date: 29/06/2022

Pot Size: $50,000 USDC

Total HM: 20

Participants: 133

Period: 5 days

Judge: hickuphh3

Total Solo HM: 1

Id: 142

League: ETH

Putty

Findings Distribution

Researcher Performance

Rank: 90/133

Findings: 1

Award: $47.15

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L526-L535

Vulnerability details

Impact

  1. There is no control code in the function cancel() to determine which status can be canceled. If the order maker cancels the order through an attacking contract after it has been filled. There will be ambiguity in contract logic -- a canceled order will still be executed.

Add order status variable to struct order and add control process.

#0 - outdoteth

2022-07-07T13:58:59Z

Duplicate: Order can be cancelled even if order was already filled: https://github.com/code-423n4/2022-06-putty-findings/issues/396

#1 - HickupHH3

2022-07-11T00:43:58Z

Warden did not submit other issues; this is his QA report

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter