# Reduce-only orders can be used to inflate quoteOI and DoS the orderbook

Reduce-only BUY orders with tiny size and max price inflate quoteOI in GTE perps book, causing other users' BUY orders to overflow and revert.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: VinciGearHead
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-08
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** perps order book (Book.sol addOrderToBook / _updateBookPostOrder)
**Root cause:** addOrderToBook unconditionally adds order.amount*order.price to metadata.quoteOI for BUY orders, including reduce-only orders that require no collateral, so an attacker can set an arbitrarily large price with tiny size.
**Steps:**
1. Place a reduce-only BUY order with amount=1 wei and price near type(uint256).max.
2. addOrderToBook calls _updateBookPostOrder, which does `self.metadata.quoteOI += order.amount.fullMulDiv(order.price, 1e18)`, pushing quoteOI to near uint256 max.
3. Subsequent legitimate BUY orders that add to quoteOI overflow and revert, blocking the bid side of the book.
**How found:** Code review of addOrderToBook noting reduce-only orders skip collateral yet still flow into _updateBookPostOrder's quoteOI accumulation, then reasoning that price is attacker-controlled and unbounded.
**Exploitation:** Attacker submits a reduce-only BUY order with minimal size and extreme price; no collateral is required for reduce-only, so quoteOI is inflated to near uint256 max at negligible cost, causing all later BUY placeOrder calls to revert via overflow.
**Insight:** When a field like open interest is derived from user-supplied price*amount, check whether order types exempt from collateral (reduce-only, post-only) can still mutate that accumulator; unbounded price on a zero-cost order is a cheap DoS primitive.