ITT
ITT copied to clipboard
vulnerable to DoS attack using making many Buy/Sell orders
If attacker makes many buy/sell orders differentiating slight price gap and requesting very small amount of (bidding/asking) tokens, contract might be in denial of service state in which every transaction would get Out-Of-Gas exception (beyond block gas limit), and ITT contract will be halted..
vulnerable code for DoS attack :
- CLL.seek in make function
- while loop in take function
How do you think about this?
Let me think on it more but,
The while loop in take
exits gracefully when gas gets too low and sets the make
parameter to false
so no make is attempted which would lead to spread collisions.
The seek()
function is used for price insertion. It enters at the spread and works up or down the pricebook depending on side
. It could go OOG but only for the attacker who is maker. It would certainly be inefficient for the taker but wouldn't DOS completely.