_checkDelay is not properly implemented due to failure to check the open case

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/Trading.sol#L857-L868

Vulnerability details

Impact

Detailed description of the impact of this finding.
_checkDelay is not properly implemented due to failure to check the open case in the following line:

if (_delay.actionType == _type) {

As a result, the purpose of profit-taking in the same or close blocks cannot be prevented as the documentation requires "This is to prevent profitable opening and closing in the same tx with two different prices in the "valid signature pool""

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/Trading.sol#L857-L868

Tools Used

Remix

Recommended Mitigation Steps

This is probabally a typo the fix is easy as follows:

function _checkDelay(uint _id, bool _type) internal {
        unchecked {
            Delay memory _delay = blockDelayPassed[_id];
            if (_type) { // @audit< this the open case
                blockDelayPassed[_id].delay = block.number + blockDelay;
            } else {         // @audit this is the close case
                if (block.number < _delay.delay) revert("0"); //Wait
                blockDelayPassed[_id].delay = block.number + blockDelay;
                blockDelayPassed[_id].actionType = _type;
            }
        }
    }

[GalloDaSballo]

Basically dup of #108 but the warden didn't "twist the knife" and used it to profit, so am awarding 50%

[c4-judge]

GalloDaSballo marked the issue as duplicate of #108

[GalloDaSballo]

Recommend you write a coded POC next time, it will help identify the risk free attack

[c4-judge]

GalloDaSballo marked the issue as partial-50

[c4-judge]

GalloDaSballo changed the severity to 2 (Med Risk)