#  MarginTradingHook#updateOrder lacks access control

MarginTradingHook.updateOrder omits an order-owner check, letting any user with an open position overwrite another user's active stop-loss order parameters.

- Payout: Contest reward
- Severity: high
- Program: INIT Capital
- Credited: sashik\_eth
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-init-capital-invitational-findings/issues/34
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-init-capital-invitational%3AH-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** MarginTradingHook.updateOrder (Solidity smart contract)
**Root cause:** updateOrder verifies the caller has an open position but never checks that order.initPosId matches the caller's initPosId, so any position holder can mutate any active order.
**Steps:**
1. Alice opens a position and adds a stop-loss order via _addStopLossOrder, recording orderIdAlice.
2. Bob opens his own position, obtaining posIdBob and a valid initPosId.
3. Bob calls `hook.updateOrder(posIdBob, orderIdAlice, triggerPrice_e36 - 1, tokenOut, limitPrice_e36, 1000)`.
4. Assert `hook.getOrder(orderIdAlice).triggerPrice_e36 == triggerPrice_e36 - 1` confirms Alice's order was overwritten.
**How found:** Code review of updateOrder: noticed it validates order status and caller position existence but compares no ownership between order.initPosId and the caller's initPosId, unlike cancelOrder.
**Exploitation:** Attacker with any open position calls updateOrder passing the victim's orderId; the function only checks order.status==Active and that msg.sender has a position, then overwrites triggerPrice, limitPrice, collAmt and tokenOut of the victim's order.
**Insight:** When an update/mutate function re-derives a caller identity (initPosIds[msg.sender][_posId]) but never compares it to the stored resource owner field, the resource is globally writable; diff such functions against sibling functions like cancelOrder that do the ownership check.