cowprotocol / cowprotocol/contracts
Zero-amount fill-or-kill orders can be executed more than once
Nobody has claimed this yet.
- Dominant language
- Solidity
- Stars
- 158
- Forks
- 56
- Avg merge
- 9h 40m
- Merged PRs (30d)
- 1
Description
We currently rely on filledAmount[orderUid] to determine if a fill-or-kill order was executed or not. However, if sellAmount is zero (and buyAmount is zero, as noted below) and the order is executed then filledAmount does not change, which means that the order can be executed again. This is problematic as the fee would be taken multiple times from the user.
This is not critical for normal user orders as we don't generate zero-sell-amount orders in the interface. It's however unlikely but possible that a user creates an order selling nothing for a fee and would be affected by this issue. Most importantly, it could cause bugs in contracts that rely on filledAmount as well, see for example the ETH-flow contract case.
In the current code, this is not an issue for partially fillable orders.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by locating filledAmount[orderUid] and the fill-or-kill execution path, then trace how zero sellAmount and buyAmount orders are handled. Reproduce execution of the same zero-amount order twice and verify that the fee cannot be taken more than once.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- blockchain
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100