search

openware / peatio

Open-source crypto currency exchange software (https://openware.com)
https://www.openware.com
MIT License
1.04k stars 624 forks source link

Critical 2.6 Vulnerability : Order placed even if user doesn't have sufficient funds #3035

Open devshaaran opened 2 years ago

devshaaran commented 2 years ago

In case if the user does not have enough funds to buy, the order is still processed.

This bug only occurs when you buy and not when you sell.

https://github.com/openware/peatio/blob/7df3b8f117c3ddf8d4934f1d86eb533066ea0f59/app/models/order.rb#L183

Example : I have a balance of 2 USDT and I want to buy 1 ETH which costs 3000 USDT. The order is processed.