computablelabs / computablelabs/compspec
Document race conditions on large buy orders
Open
- Dominant language
- Shell
- Stars
- 2
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
It is possible for attackers to front-run large calls to `Reserve.support` to take advantage of large in-bound patron fees. The attackers can buy them immediately sell via `Reserve.withdraw`. If the boost in price is larger than `spread`, this attack can be profitable. Suggest that patrons either:
- Use a high gas fee to discourage front running
- Break support calls into smaller chunks for security
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.