Description

The Execute contract stores the block number and the first caller to trigger a limit order. However, because transactions are atomic, there is no chance for a second trigger to start between the first trigger and its callback.

Impact

In Trading.executeLimitOrder, the call to executor.triggered will always return false, and the registration and unregistration of the first bot to trigger the limit in Execute's storage is wholly unnecessary.

Recommendations

To save gas, the entire Execute contract can be replaced with transferring the execution fee to the sender in executeLimitOrder as well as ensuring that the callback either successfully executes the trigger or reverts.

Remediation

This issue has been acknowledged by Avantis Labs, Inc., and a fix was implemented in commit aadd8210↗.