Submitted by cmichel
The Liquidation contract allows the liquidator to submit bad trade orders and the insurance reimburses them from the insurance fund, see Liquidation.claimReceipt.
The function can be called with an orders array, which does not check for duplicate orders.
An attacker can abuse this to make a profit by liquidating themselves, making a small bad trade and repeatedly submitting this bad trade for slippage reimbursement.
Example:
This can be repeated until the insurance fund is drained.
The attacker has an incentive to do this attack as its profitable and the insurance fund will be completely drained.
Recommend disallowing duplicate orders in the orders argument of claimReceipt. This should make the attack at least unprofitable, but it could still be a griefing attack.
A quick way to ensure that orders does not contain duplicates is by having liquidators submit the orders in a sorted way (by order ID) and then checking in the calcUnitsSold for loop that the current order ID is strictly greater than the previous one.
BenjaminPatch (Tracer) confirmed:
