Skip to content
Request an audit

‹ All findings

OstiumTradesUpKeep Triggers Automation for Pending Orders Expected to Fail

Low/InfoOstium·Three Sigma · RWA perpetuals DEX · 19th February, 20243S-OS-L01

Description

In OstiumTradesUpKeep::_getOpenOrdersToTrigger(), orders are grouped together for execution without some important checks.

This means that some orders that should be triggered can fail due to checks in OstiumTrading::executeAutomationOrder() or in the execution functions of OstiumTradingCallbacks.

For example, when fetching trades for liquidation in OstiumTradesUpKeep::_getOpenOrdersToTrigger(), there's no check to see if the trade has a stop loss.

This means these orders won't execute because of this check in the OstiumTrading::executeAutomationOrder().

Note: this check should also be added to OstiumTradingCallbacks::executeAutomationCloseOrderCallback().

Also, checks for market closure, max allowed leverage per pair and the pause status of the OstiumTradingCallbacks contract, are missing in OstiumTradesUpKeep::_getLimitOrdersToTrigger(), which means that these orders will fail inside the OstiumTradingCallbacks::executeAutomationOpenOrderCallback().

Recommendation

Review the checks in OstiumTrading::executeAutomationOrder() and the execution functions of OstiumTradingCallbacks, and make sure similar checks are added to the functions responsible for fetching orders in OstiumTradesUpKeep. This ensures that only orders likely to succeed are triggered, saving gas.

Status

Acknowledged