# _validateOrder Does Not Allow Anyone To Be A Taker Of An Off-Chain Order

EIP1271Wallet._validateOrder omits takerAddress/senderAddress zero-checks, letting the treasury manager restrict 0x off-chain orders to themselves and extract value via max slippage.

- Payout: Audit contest
- Severity: medium
- Program: Notional
- Found by: leastwood
- Disclosed: 2022-03-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-notional-findings/issues/152
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** EIP1271Wallet 0x order validation (Solidity)
**Root cause:** _validateOrder checks feeRecipient, tokens, oracle and slippage but never requires takerAddress and senderAddress to be address(0), so the manager can set them to themselves.
**Steps:**
1. Manager signs a 0x off-chain order via EIP1271Wallet with `takerAddress` and `senderAddress` set to the manager's own address instead of address(0).
2. Order passes _validateOrder since only feeRecipient/tokens/oracle/slippage are checked.
3. Manager sets makerPrice at the slippage floor (maximizing allowed slippage) to extract value from treasury.
4. Manager fills the order as the sole permitted taker/sender; no other user can fill it.
**How found:** Manual code review of _validateOrder against 0x LibOrder semantics; noticed the function validates feeRecipient but not takerAddress/senderAddress, whose zero value is what makes orders openly fillable.
**Exploitation:** Treasury manager crafts an off-chain 0x order with takerAddress/senderAddress set to themselves and makerPrice at the slippage floor, then fills it as the only allowed taker, capturing the slippage spread from the TreasuryManager's harvested assets.
**Insight:** When a contract wraps an external protocol's order validation, diff its require-checks against the protocol's field semantics (e.g. 0x zero-address = permissionless); missing zero-checks on taker/sender fields silently convert open orders into privileged ones.