# Order bounds not revalidated at fill

Creation-time order bounds (size, SL/TP, trigger) not re-checked, or wrongly re-checked, against the fill price

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-11-22. Updated 2026-10-23._

## How it works
An order is validated against a price when created: minimum size, stop/take-profit bounds, trigger conditions. Between creation and execution the price moves. The execution path then either skips those checks against the fresh price, or re-applies a creation-time threshold that no longer makes sense. Either way the order fills (or fails) under conditions the creator never agreed to. The broken assumption is that the price at creation equals the price at fill.

## Where it shows up
- Execution functions that overwrite a stored order price with a fresh feed value but skip the bound checks done at creation [E3](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-18.md).
- A size/value threshold enforced at creation and re-enforced at fill against a changed price [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AM-9.md).
- Trigger checks that assume price crosses gradually rather than gapping past the trigger in one block [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-7.md).
- Any `execute*Order` that mutates `price`, `minOut`, or SL/TP fields without re-running validation.

## How to review
Trace every field validated at order creation and confirm it is re-validated at fill against the price actually used. The invariant: for any order that fills, all creation-time bounds (min size, SL/TP, trigger) hold against the execution price, not the creation price. Distinguish intended re-checks (a threshold that should hold at fill) from missing ones (a bound that should be re-applied but is not); both are bugs when they diverge from intent [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AM-9.md)[E3](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-18.md). Concretely: if `createOrder` checks `usdValue >= minSize` and `executeOrder` recomputes `usdValue` at the new price, ask whether the second check is intended or accidental. Check what happens when price gaps past a trigger in one block rather than crossing gradually [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-7.md).

## Variants seen
- Min-size check passes at creation, reverts at fill after a price drop because the threshold is re-applied at the lower price [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AM-9.md).
- Stop order opens at feed price but SL/TP never re-checked, so it opens and instantly closes at a loss [E3](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-18.md).
- Strict straddle requirement on trigger price makes limit/stop-loss orders revert when prices gap past the trigger [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-7.md).

## Impact and severity
Medium to high: orders that cannot fill or revert unexpectedly [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AM-9.md), trades opening at an immediate loss [E3](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-18.md), and users unable to exit positions during gaps [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-7.md). Severity rises when the gap is exploitable for profit rather than only causing failed fills, and when the divergence affects a whole order type.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-7.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AM-9.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-18.md