# DoS in Solana when filling orders

Solana CreateOrder stores a user-supplied order_hash without validating it against order data, so mismatched hashes make orders unfillable and unfundable-revertable, causing DoS and permanent fund loss.

- Payout: Contest reward
- Severity: high
- Program: Genius
- Credited: Jonatas Martins
- Disclosed: 2025-09-04
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_genius_jul2025.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Agenius_jul2025%3A3.1.2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:high tech:solana tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** Solana CreateOrder instruction and off-chain solver orchestrator (SolverBase/SolverFactory)
**Root cause:** CreateOrder stores the caller-supplied order_hash without verifying keccak256(order data) matches it; the off-chain solver recomputes the hash via GeniusEvmVault.getOrderHash, so a mismatched hash yields wrong status lookups and the order is filtered out.
**Steps:**
1. Call CreateOrder on Solana with valid order fields but an order_hash that does not equal keccak256(abi.encode(order)).
2. Order account is created seeded by the bogus hash; status set to Created.
3. Orchestrator runs getOrderHashesToCheck which recomputes the hash from order data, not the stored one.
4. getOrderStatuses queries Solana pool with the recomputed hash, returning Nonexistant/wrong status.
5. executeSolver filter requires sourceStatus==Created && destStatus==Nonexistant, so the order is skipped and never filled.
6. getRevertOrderTx derives orderAddress from recomputed hash, which was never created, so revert tx fails.
**How found:** Code review of CreateOrder instruction noting order_hash stored without keccak256 validation, then tracing the off-chain solver path (solver-lit-impl.go → SolverBase → SolverFactory.executeSolver → getOrderHashesToCheck) to see the hash is recomputed and mismatches break status filtering and revert address derivation.
**Exploitation:** Attacker creates small orders on Solana paying only fees, frontrunning the orchestrator with a valid filled order hash to block legitimate fills; or a user submitting a mismatched hash permanently locks funds since the order can neither be filled nor reverted until orchestrator code is patched.
**Insight:** When on-chain state stores a hash supplied by the user, check whether off-chain components recompute that hash from data instead of reading the stored value; any divergence between stored and recomputed identifiers silently breaks status lookups and address derivation, turning a validation gap into a DoS/lockup.