search

sherlock-audit / 2023-12-flatmoney-judging

11 stars 9 forks source link

kgothatso - user can call `announceLimitOrder` with same tokens #244

Closed sherlock-admin2 closed 7 months ago

sherlock-admin2 commented 8 months ago

kgothatso

medium

user can call announceLimitOrder with same tokens

Summary

user can call announceLimitOrder with same tokens

Vulnerability Detail

user can call announceLimitOrder with same tokens and cancel one order limit cancelLimitOrder

Impact

incorrect calculation for liquidation

Code Snippet

https://github.com/sherlock-audit/2023-12-flatmoney/blob/main/flatcoin-v1/src/LimitOrder.sol#L58

https://github.com/sherlock-audit/2023-12-flatmoney/blob/main/flatcoin-v1/src/LimitOrder.sol#L87

Tool used

Manual Review

Recommendation

check to see if token has been used to make announceLimitOrder if yes then revert

sherlock-admin commented 7 months ago

1 comment(s) were left on this issue during the judging contest.

takarez commented:

invalid

nevillehuang commented 7 months ago

Invalid, almost no impact of issue described