# OstiumTrading::closeTradeMarket() and OstiumTrading::topUpCollateral() are missing pending trigger checks Medium · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-M04 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description [OstiumTrading::closeTradeMarket()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTrading.sol#L250) and [OstiumTrading::topUpCollateral()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTrading.sol#L388) can be used to frontrun liquidation calls whose trigger has already been set, making the liquidation fail in OstiumPriceUpKeep::performUpkeep(), draining fees and gaming the system. ### Recommendation Add [OstiumTrading::checkNoPendingTrigger()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTrading.sol#L578) to both functions. ### Status Addressed in [#7a80be7](https://github.com/0xOstium/smart-contracts-threeSigma/pull/58/commits/7a80be7e623ad8ad4fc7dd84bddc354cbfb5c4ff). --- Related findings: - [_match() always checks the trigger of the first order of a certain tick, instead of checking i order](https://0xsimao.com/findings/nftperp-ii-match-certain-tick-checking): Nftperp Matching Engine - [Liquidation can be finished without calling triggerDefault() (and repossessing the loan) if pool delegate or governor call finishCollateralLiquidation(...) after impairment.](https://0xsimao.com/findings/maple-finance-iii-liquidation-repossessing-delegate-collateral): Maple Finance - [Missing documentation for MapleLoan, SetPendingLender and AcceptLender being implemented on MapleLoan but not on LoanManager.](https://0xsimao.com/findings/maple-finance-iii-documentation-pending-accept-implemented): Maple Finance - [Attacker can trigger temporary shutdown due to RedStonePriceFeedBase missing gas check](https://0xsimao.com/findings/felix-temporary-shutdown-price-gas): Felix Price Feeds