# OstiumTrading::executeAutomationOrder() and _getLimitOrdersToTrigger() should check isPaused for open limit orders Medium · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-L14 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description OstiumTrading::openTrade() correctly checks isPaused to not allow opening positions when the protocol is paused. However, [executeAutomationOrder()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTrading.sol#L420) still allows execution if it is an open limit order, which it should not, as it will fail when [OstiumPriceUpKeep()::performUpKeep()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumPriceUpKeep.sol#L103) executes. Moreover, it will not discount oracle fees if it is paused or the market has been closed. ### Recommendation Check if OstiumTradingCallbacks is paused in OstiumTradingUpKeep() and in OstiumTrading::executeAutomationOrder() for open limit orders. ### Status Acknowledged --- Related findings: - [getTriggerOrders() should be paginated or it may revert if enough orders are created](https://0xsimao.com/findings/nftperp-i-orders-paginated-revert-created): Nftperp Exchange - [_match() always checks the trigger of the first order of a certain tick, instead of checking i order](https://0xsimao.com/findings/nftperp-ii-match-certain-tick-checking): Nftperp Matching Engine - [Attacker can trigger temporary shutdown due to RedStonePriceFeedBase missing gas check](https://0xsimao.com/findings/felix-temporary-shutdown-price-gas): Felix Price Feeds - [reduceOnly limit order update does not take into account that a new amm may be selected, which may lead to loss of funds](https://0xsimao.com/findings/nftperp-i-reduce-account-amm-selected): Nftperp Exchange