Skip to content
Request an audit

‹ All findings

ClearingHouse::addEngine() initializes productEngine, so it may be frontrunned and someone initializes productEngine instead

Low/InfoVertex·by the Three Sigma team·Hybrid orderbook DEX·3rd April 20243S-Vertex-L08

Report PageSource

Description

ClearingHouse::addEngine() initializes productEngine, which means it is uninitialized prior to the call. Thus, someone may spot the uninitialized productEngine proxy and initialize it themselves, making the addEngine() call revert.

Recommendation

Send the productEngine creation and ClearingHouse::addEngine() atomically, via a multicall or custom contract deployer.

Status

Acknowledged

Found during Three Sigma’s team review · 0xSimao on the review team