search

sherlock-audit / 2024-02-rubicon-finance-judging

5 stars 3 forks source link

yujin718 - executeWithCallback() always ignore _fill() #6

Closed sherlock-admin closed 7 months ago

sherlock-admin commented 7 months ago

yujin718

high

executeWithCallback() always ignore _fill()

Summary

executeWithCallback() execute part of a single order using given callback data. But reactorCallback() reverting always. So all transactions reverting.

Vulnerability Detail

reactorCallback() always reverting. so when call executeWithCallback(), it will always revert transactions.

https://github.com/sherlock-audit/2024-02-rubicon-finance/blob/main/gladius-contracts-internal/src/lens/GladiusOrderQuoter.sol#L74-L85

executeWithCallback() call reactorCallback() and then processing _fill() but it will never process.

https://github.com/sherlock-audit/2024-02-rubicon-finance/blob/main/gladius-contracts-internal/src/reactors/BaseGladiusReactor.sol#L123-L127

Impact

It will never process fills a list of orders. consider high risk.

Code Snippet

https://github.com/sherlock-audit/2024-02-rubicon-finance/blob/main/gladius-contracts-internal/src/reactors/BaseGladiusReactor.sol#L123-L127

Tool used

Manual Review

Recommendation

call _fill() properly, it should be avoid revert.

sherlock-admin commented 7 months ago

1 comment(s) were left on this issue during the judging contest.

0xAadi commented:

Invalid: reactorCallback will not revert always