interfaceFeeAmount1 occupies old interfaceFeeUnwrap
If there is an old order, the interfaceFee parsed after the update will be wrong
Possible scenarios
interfaceFee1.amount is cleared to 0 because interfaceFeeAmount solt is deprecated.
the new interfaceFee1.amount will be very large if the old order has unwrap=true (interfaceFee1.amount uses the old unwrap position)
interfaceFee1.amount= [unwrap+0000000000]= [0x010000000000] = ~1M fees (0x010000000000 / 1e6)
bin2chen
high
MultiInvoker is not backward compatible
Summary
TriggerOrder
addedinterfaceFee2
and modified the oldsolt
May cause old orders to use the wrongfees
valueVulnerability Detail
New version of
TriggerOrder
addsinterfaceFee2
. Also modified oldinterfaceFee.amount
andinterfaceFee.unwrap
solt positionsOld version:
New version:
If there is an old order, the
interfaceFee
parsed after the update will be wrong Possible scenariosthe new
interfaceFee1.amount
will be very large if the old order hasunwrap=true
(interfaceFee1.amount uses the old unwrap position)interfaceFee1.amount= [unwrap+0000000000]= [0x010000000000]
= ~1M fees (0x010000000000 / 1e6)Also
unwrap
becomes falseImpact
Old orders use the wrong
fees
valueCode Snippet
https://github.com/sherlock-audit/2024-02-perennial-v2-3/blob/main/perennial-v2/packages/perennial-extensions/contracts/types/TriggerOrder.sol#L19
Tool used
Manual Review
Recommendation
interfaceFee1 follows the old interfaceFee's solt position interfaceFee2 adds backward
read()
/store()
modify accordinglyDuplicate of #12