TradeUtils is used as a library for the address type
In OstiumTrading, the library TradeUtils is used for the address type:
contract OstiumTrading is IOstiumTrading, Delegatable, Initializable {
using TradeUtils for address;
This is done in order to be able to directly use the return value of a call to registry.getContractAddress
to call convenience functions in the library. However, attaching the library to address
is overly broad and allows invalid calls like this to compile:
msg.sender.setTradeLastUpdated( /* [...] */ );
Moreover, it is unclear at a glance what is actually being called because the function in OstiumTradingCallbacks is also called setTradeLastUpdated
but has a different signature, and the layer of calls in the library is hidden.
This issue has been acknowledged by Ostium Labs, and a fix was implemented in commit 9b977c93↗.