QA Report

[code423n4]

CodeArena QA Report

Vulnerability detail - Duplicate Code

Impact

The validateOrder() function in GolomTrader.sol checks twice that the recovered signature signer is o.signer.

Details/Proof-Of-Concept

The following code is encountered from L177 of GolomTrader.sol:

require(signaturesigner == o.signer, 'invalid signature');
if (signaturesigner != o.signer) {
    return (0, hashStruct, 0);
}

The require() statement ensures that the following condition is never met. If signaturesigner and o.signer don't match the transaction will revert with an 'invalid signature' error instead of returning a status code of 0.

Suggested Mitigation Steps

Remove the if statement from L178-L180.

Tools Used

Saw it reading in VSCode

[kartoonjoy]

Edited the word Gas report to QA report in the wardens title. Warden 0xMatt is aware. Thanks