GTE CLOB — amend bypasses maxLimitsPerTx

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 64871-h-03-dos-attack-via-order-amendment-bypassing-maxlimitspertx. Standalone Foundry PoC and full write-up: 64871-h-03-dos-attack-via-order-amendment-bypassing-maxlimitspertx_exp in the evm-hack-registry mirror.

Vulnerability classes: dos-resistance · temporary · account-ownership

Reproduction: self-contained Foundry PoC with only forge-std. Full trace: output.txt. PoC: test/64871-h-03-dos-attack-via-order-amendment-bypassing-maxlimitspertx_exp.sol.

AuditVault taxonomy: lang/solidity · platform/code4rena · has/github · has/poc · severity/high · sector/dex · genome: dos-resistance · temporary · frozen-funds

Key info#

TL;DR#

1. postLimitOrder enforces maxLimitsPerTx via incrementLimitsPlaced.
2. amend to a new price creates a new book position without incrementing.
3. Attacker posts up to the cap, then amends unlimited times in one tx.
4. HARM: order-book flooding / DOS protection bypass.

The vulnerable code#

function amend(...) external {
    // @> VULN: no incrementLimitsPlaced when price/side changes
    return _processAmend(ds, order, args);
}

Fix: call incrementLimitsPlaced when price or side changes.

Root cause#

Amend-to-new-price is operationally a new limit placement but not rate-limited.

Preconditions#

• Ability to post at least one limit order.
• maxLimitsPerTx configured (DOS guard present).

Attack walkthrough#

1. Post maxLimitsPerTx orders (third post reverts).
2. Amend first order across 50 prices in the same tx.
3. Limits counter stays at 2; book sees 50 new levels.

Diagrams#

Impact#

Bypasses the protocol's per-tx order-book spam protection.

Sources#

• AuditVault: https://github.com/Auditware/AuditVault/blob/main/findings/64871-h-03-dos-attack-via-order-amendment-bypassing-maxlimitspertx.md
• Report: https://code4rena.com/reports/2025-07-gte-spot-clob-and-router
• Repo@commit: https://github.com/code-423n4/2025-07-gte-clob/blob/9f06332ebd4cfe2577d9eae81aeb58d3662ffccd/contracts/clob/CLOB.sol#L390

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 64871-h-03-dos-attack-via-order-amendment-bypassing-maxlimitspertx_exp (evm-hack-registry mirror).
• AuditVault finding: 64871-h-03-dos-attack-via-order-amendment-bypassing-maxlimitspertx.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.