Orbiting Rosewood Swallow - Malicious users can createOrder with 0 amount and make DOS for all

[sherlock-admin2]

Orbiting Rosewood Swallow

High

Malicious users can createOrder with 0 amount and make DOS for all

Summary

Malicious users can createOrder with 0 amount and can cause DOS / block users to fillOrder, cancleOrder

Impact

Malicious users will create huge numbers of orders with 0 amountIn.

Now if anyone wants to fillOrder or cancleOrder they can not do it because:

• Due to the block gas limit, there is a clear limitation in the amount of operation that can be handled in an Array.
• ArrayMutation::removeFromArray is called on fillOrder, cancleOrder functions.
• Now because the malicious users have created a huge amount of orders with 0 amount,
• When normal users go to fillOrder or cancleOrder they simply run out of gas while iterating a huge array of pendingOrderIds.
• This makes them and every one impossible to do any further action on fillOrder, cancleOrder

PoC

OracleLess::createOrder

    function createOrder(
        IERC20 tokenIn,
        IERC20 tokenOut,
        uint256 amountIn,
        uint256 minAmountOut,
        address recipient,
        uint16 feeBips,
        bool permit,
        bytes calldata permitPayload
    ) external override returns (uint96 orderId) {
        //procure tokens
        procureTokens(tokenIn, amountIn, recipient, permit, permitPayload);

        //construct and store order
        orderId = MASTER.generateOrderId(recipient);
        orders[orderId] = Order({
            orderId: orderId,
            tokenIn: tokenIn,
            tokenOut: tokenOut,
            amountIn: amountIn,
            minAmountOut: minAmountOut,
            recipient: recipient,
            feeBips: feeBips
        });

        //store pending order
        pendingOrderIds.push(orderId);

        emit OrderCreated(orderId);
    }

Mitigation

We can add checks for the createOrder function something like this

require(amountIn > 0, "amount should be greater than 0")

Or can add code like the other Contracts

MASTER.checkMinOrderSize(tokenIn, amountIn);

[sherlock-admin2]

The protocol team fixed this issue in the following PRs/commits:
gfx-labs/oku-custom-order-types#1