Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Chainflip Backend>Threat Model>Function: `update_limit_order`
GeneralOverview
Findings
Critical (1)
High (1)
Medium (1)
DiscussionLack of broker fee limitsERC-20 transfer reversions result in stuck fundsType conversion could lead to fund loss
Threat ModelWhat are threat models?1-cf-lp
2-cf-poolsPallet: cf-poolsFunction: `update_buy_interval`Function: `update_pool_enabled`Function: `new_pool`Function: `update_range_order`Function: `set_range_order`Function: `update_limit_order`Function: `set_limit_order`Function: `set_pool_fees`Function: `on_initialize`
3-cf-swapping4-cf-witnesser5-engine
Audit ResultsSummary

Function: update_limit_order

The update_limit_order function can be used to create or update an existing limit order. The function takes the amount that should be added to or subtracted from the limit order. It also receives an order ID and a price level.

If the order ID is associated with an existing order, that order will be updated; in this case, the price level is optional, and if provided the order will also be moved from the current to the newly specified price level. If the order ID does not correspond to an existing order, the price level must be specified, as a new order will be created at the specified level.

The function ensures that safe mode is not enabled and that the caller is a registered liquidity provider. If an existing order ID and a new price level were provided, it moves the existing order to the new price level.

It then updates the order, increasing or decreasing the associated liquidity by the given amount. Note that the increase or decrease can be specified in terms of an amount of assets or in terms of liquidity.

As in the case of the functions handling range orders, the user balance is updated every time their position is changed, ensuring the balance is always consistent with the position.

Zellic © 2024Back to top ↑