Anybody can cancel orders made by RubiconRouter

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L440

Vulnerability details

Anybody can cancel an offer made by [another user using RoubiconRouter].

Impact

If a user created an offer which wasn't fully filled, anybody (including bots) can swoop in, cancel it, and get the user's funds.

Proof of Concept

Anybody can create an offer using offerForETH. The router does not save the offer's originator.
Then by calling 'cancelForETH', which does not check who called it, anybody can sweep the user's funds.

Recommended Mitigation Steps

Few options are there -

• Consider saving in the router the offer's originator - although that ruins the router's statelessness
• Consider adding a parameter to RubiconMarket's offer function (\overload) that will allow passing who can cancel the offer
• Consider removing the functionality altogether
• Consider adding a comment warning the user of the risk of using this functionality
• Consider the futility of constantly trying to chase happiness

[bghughes]

Duplicate of #17