# Malicious user can spam orders that expire immediately or cancel them immediately to wipe out legit orders from a book with orders only on one side

Attacker spams short-lived higher-priced orders across accounts to evict all legit limits from a one-sided CLOB book, then expires/cancels them.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: gesha17
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-07-gte-spot-clob-and-router#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** CLOB order book limit placement (clob/CLOB.sol)
**Root cause:** No minimum order liveness enforced on cancelTimestamp, and when maxNumLimitsPerSide is reached the worst limit is evicted in favor of any higher-priced incoming order, so cheap expiring orders can displace legit ones.
**Steps:**
1. Identify a book with active orders on only one side (e.g. bids only).
2. Submit many limit orders priced above the current worst limit with `cancelTimestamp` set to the next second, using multiple accounts to bypass per-tx limit caps.
3. Each placement hits `ds.bidTree.size() == maxNumLimitsPerSide` and calls `_removeNonCompetitiveOrder` on the worst legit order.
4. Let orders expire (or call `cancel()` next tx) to reclaim funds, leaving the book wiped.
**How found:** Noticed no minimum validity restriction on cancelTimestamp combined with the eviction branch in `_executeBidLimitOrder` when the book is full, and reasoned that higher-priced expiring orders would displace legit ones on a one-sided book.
**Exploitation:** Attacker risks only brief capital lockup; if orders aren't filled within one second they expire and are refunded, while legit orders are evicted from the full book.
**Insight:** When a bounded data structure evicts the 'worst' entry on overflow, check whether an attacker can cheaply inject entries that rank above victims but carry no real commitment (short expiry, instant cancel) to force eviction.