# DOS Attack via Order Amendment Bypassing maxLimitsPerTx Protection

CLOB amend() moves orders to new price/side without incrementing maxLimitsPerTx counter, letting any user flood the order book in one tx.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: eightzerofour
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-07-gte-spot-clob-and-router#h-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AH-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** CLOB.sol amend() / postLimitOrder limit counter
**Root cause:** amend() never calls incrementLimitsPlaced() even when _executeAmendNewOrder removes and re-places the order at a new price/side, effectively creating a new book entry. postLimitOrder enforces the per-tx limit but amend does not.
**Steps:**
1. Place 2 limit orders via `postLimitOrder` to obtain orderIds (minimal capital).
2. Call `amend(account, {orderId, price: newPrice, side, amountInBase, cancelTimestamp})` repeatedly in one tx, each time changing price or side.
3. Each amend routes to `_executeAmendNewOrder` -> `_executeBidLimitOrder`/`_executeAskLimitOrder`, inserting a new book position.
4. Observe no `LimitsPlacedExceedsMax()` revert despite exceeding maxLimitsPerTx; order book flooded with unlimited price levels.
**How found:** Code review comparing postLimitOrder (which calls incrementLimitsPlaced) against amend(), noticing the amend path reaches _executeAmendNewOrder which removes and re-inserts the order at a new price/side without any limit accounting.
**Exploitation:** Any user with capital for two initial orders amends them across many distinct price levels within a single transaction, generating unbounded order book churn and bypassing the DOS guard; repeatable across transactions to sustain flooding.
**Insight:** When a protocol caps per-tx state creation, audit every alternate mutation path (amend, modify, replace) that can re-create the same state; compare each entrypoint's counter increments against the canonical create path.