Description

The CLOB contract organizes orders by a defined tick spacing that is validated on all limit and fill orders. However, amendments do not validate tick spacing for price amendments. This leads to orders that fall outside the traditional tick-spaced--orders bounds.

If many orders exist in a single price-tick range (say 6.15e18), a malicious user can game the ordering by amending their order's price to 6.150000001e18. This has negligible effect on the price but will push their order in front of all existing orders.

Impact

Ordering of orders in the CLOB is not guaranteed, leading to unfair distribution of sellers to makers.

Recommendations

Implement the BookLib.assertLimitPriceInBounds(ds, args.priceLimit); for all price amendments to the order book.

Remediation

This issue has been acknowledged by Liquid Labs, Inc., and a fix was implemented in commit 5e82bd34↗.