Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Tradoor>Threat Model>Message: CancelPerpOrder
GeneralOverview
Findings
High (1)
Medium (1)
Low (1)
Informational (4)
DiscussionTest suiteUnused isPending flag on perpetual ordersLimited contract storage enables denial-of-service attacks
Threat ModelWhat are threat models?
1-usdt_pool.tactMessage: ListTokenMessage: CancelPerpOrderMessage: ExecutePerpOrderMessage: LiquidatePerpPositionMessage: ADLPerpPositionMessage: UpdateBaseConfigMessage: SetManagerMessage: JettonUpdateContentMessage: DelistTokenMessage: ClaimProtocolFeeMessage: FeedPricesMessages: CreateCompensate and ExecuteOrCancelCompensateMessage: JettonTransferNotificationMessage: CancelLiquidityOrderMessage: ExecuteLiquidityOrderMessage: CreateDecreasePerpOrderMessage: CreateTpSlPerpOrder
2-ton_pool.tact
Audit ResultsAssessment Results

Message: CancelPerpOrder

This operation allows the owner of an order or an executor to cancel an inserted order.

An executor can cancel an order at any time. The order owner can only cancel market orders after they have been pending for the orderLockTime configured for the pool.

The message must carry enough TON to cover for the cancelPerpOrderGas gas fees plus the transferJettonGas costs (configured in the contract) if the order being canceled was to increase a position, since canceling orders increasing a position requires returning the jettons deposited when the order was created.

Orders to increase a perpetual position can also have associated take-profit/stop-loss conditions; in case they do, the additional execution fees paid in advance are also refunded to the owner of the order.

Next, any take-profit/stop-loss execution fees deposited in advance as well as the collateral deposited for position-increase orders are refunded to the order owner.

Execution fees paid for the order itself (not for the take-profit/stop-loss conditions) are sent to the execution-fee receiver address optionally specified in the message. If unspecified, this address defaults to the message sender.

Finally, the totalExecutionFee amount of total collected fees collected to be paid to executors is decreased to account for the reimbursements, an event signalling off-chain observers of the cancellation is emitted, and any excess TON is returned to the message sender.

Inputs

The incoming message has the following structure:

message CancelPerpOrder { executionFeeReceiver: Address?; orderId: Int as uint64; trxId: Int as uint64; }

  • executionFeeReceiver

    • Validation: None.

    • Impact: Optional address that will receive the execution-fees reimbursement.

  • orderId

    • Validation: Must be an existing, nonpending order (owner by the message sender if not an executor).

    • Impact: Identifies the order to be canceled.

  • trxId

    • Validation: None required.

    • Impact: Used as a message identifier in the transfer message returning jettons to the order owner — does not affect the contract logic.

Test coverage

Intended branches

Negative behavior

Zellic © 2025Back to top ↑