# Order book eviction and freeze DoS

Cheap or post-only orders that freeze a side, inflate accumulators, or evict real orders

_Area: Smart contract access control and control flow. Seen in 4 disclosed reports; latest 2026-02-05. Updated 2026-10-23._

## How it works
Order books assume that placing an order costs something and that every mutation path is bounded. Both assumptions break. A maker-only order that must be tick-aligned can sit at the lowest legal price on one side, so any legal order on the opposite side crosses it and reverts under post-only rules — one cheap order freezes a whole side [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-02.md). Accumulators derived from user-supplied price×amount can be inflated by order types that need no collateral, so later orders overflow and revert [E2](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-08.md). Per-transaction caps are enforced on one entrypoint but not on amend, so the cap is bypassed [E3](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AH-03.md). Bounded books evict the "worst" entry on overflow, so an attacker injects entries that rank above victims but carry no commitment (short expiry, instant cancel) and wipes the side [E4](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-04.md).

## Where to show up
- Post-only / maker-only orders with tick-size alignment; check whether the minimum legal price on one side can equal an attacker's best price on the other [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-02.md).
- Accumulators (open interest, quote volume) updated as `amount * price` for order types exempt from collateral (reduce-only, post-only) [E2](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-08.md).
- Per-tx or per-block limits enforced in `place` but not in `amend`/`modify`/`replace` [E3](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AH-03.md).
- Bounded per-side structures that evict on overflow, with no minimum liveness on cancel/expiry [E4](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-04.md).

## How to review
For each order type, ask: does it require collateral, and can it still mutate shared state? For each mutation entrypoint (place, amend, replace, cancel), confirm the same counters and limits increment. For post-only, verify the minimum legal price on each side cannot be occupied by an attacker to block the other side. For bounded books, confirm eviction cannot be triggered by entries with no real commitment (enforce minimum liveness, or rank by committed value). The invariant: no single cheap order can make a legal opposite-side order revert, and every state-creating path is capped identically.

## Variants seen
- Tick-aligned post-only freeze of one side [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-02.md)
- Reduce-only orders inflating quoteOI to overflow [E2](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-08.md)
- Amend bypassing maxLimitsPerTx [E3](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AH-03.md)
- Short-lived spam evicting legit limits on a one-sided book [E4](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-04.md)

## Impact and severity
Freezes the bid side and blocks liquidation backstop [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-02.md), DoSes the book for all users [E2](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-08.md), floods the book in one tx [E3](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AH-03.md), and wipes legitimate orders [E4](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-04.md). Severity is high where the frozen side is needed for liquidations or solvency; worse when the attack costs near zero and is repeatable.

## Why fixes fail
Caps on one entrypoint leave amend open [E3](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AH-03.md); collateral exemptions leave accumulators writable [E2](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-08.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-08.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AH-03.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-04.md