Merivale Markets

_payOut calls IERC20(token).transfer(to, amount) and discards the returned boolean. Some BEP-20 tokens signal failure by returning false instead of reverting. When such a transfer fails, the router continues as if the maker or taker had been paid, and the order is marked filled.

_refund returns excess BNB with payable(msg.sender).call{value: excess}("") and ignores the success flag. If the taker is a contract that rejects BNB, the refund silently stays in the router, where the next caller who triggers a refund path can receive it.

Tokens that do not return a value at all cause the opposite problem: the interface expects a boolean and the call reverts when decoding, blocking trading in those pairs. A safe-transfer wrapper handles both cases.

Makers or takers lose funds; balances stranded in the router can be captured by other users.

Use SafeERC20.safeTransfer for all token movements and revert, or credit a withdrawable balance, when a native refund fails.

Partially resolved. Token transfers now use SafeERC20. The native refund path still ignores the call result; the team plans a withdrawable refund balance.

setTakerFee(tier, bps) accepts any value up to 10,000 basis points (100%) and takes effect immediately. The operator is a single EOA. Takers specify an amount and a limit price but no maximum fee, so the fee applied is whatever the controller holds when their transaction executes.

The operator, or anyone who obtains the key, can observe a large pending swap, front-run it with a fee increase and back-run it with a reset, capturing most of the trade as fees sent to a recipient that can be changed in the same block. Listings can also be removed instantly, which blocks makers from cancelling orders in pairs that are delisted (cancellation requires an active listing).

This is a governance weakness rather than an implementation bug, but on-chain nothing limits the operator, so users must fully trust a single key.

Theft of taker funds through fees and blocking of maker cancellations, limited only by the operator's willingness to act.

Cap fees in the contract, let takers pass a maximum fee, move fee and listing changes behind a timelock with a public delay, and ensure delisting never blocks cancellation of existing orders.

Open. The team intends to introduce a 48-hour timelock and a hard fee cap in the next release.

cancelOrder(orderId) verifies msg.sender == order.maker. The batch variant cancelOrders(uint256[] ids) was added later for market makers and loops over _cancel(id) directly, skipping the check. Escrowed funds are returned to the maker, so nothing is stolen, but anyone can remove any order from the book.

The ability to clear the book at will is valuable to an attacker: removing resting liquidity just before a large taker order forces the remainder through the AMM fallback, where the attacker can sandwich it (compounded by MM-06).

Market makers lose queue position and fills; takers suffer worse execution; the order book can be emptied repeatedly at low cost.

Check the maker for every order in the batch, or have both functions call a single internal function that enforces it.

Fixed and verified; property P2 holds on the remediation commit.

_match walks the best price level order by order until the taker amount is filled. There is no minimum order size and no limit on orders visited per call. An attacker can place thousands of minimum-size orders at the best price; a taker order then consumes its gas limit filling dust and reverts, or pays very high gas for little volume.

Because orders at the best price are visited first, the attacker effectively controls access to the book for the cost of placing (and later cancelling) the dust orders.

Denial of service for takers on targeted markets.

Enforce a minimum order notional per market and cap orders visited per call, routing the remainder or returning a partial fill.

Partially resolved. A cap of 64 orders per match was added; a minimum order size is still pending.

_pullIn transfers amountIn from the taker and proceeds to match amountIn. For tokens that charge a fee on transfer, the router receives less than amountIn and fills the difference from tokens it already holds, such as unclaimed refunds or tokens in transit within the same transaction.

The listing manager does not reject fee-on-transfer tokens, and the router keeps transient balances, so a token designed to charge a large fee lets an attacker drain whatever the router holds in that token.

Loss of tokens held by the router; incorrect fills for makers.

Measure the balance before and after the transfer and use the difference, and reject fee-on-transfer tokens at listing.

Fixed. Transfers that deliver less than requested revert, and listings test transfer behaviour.

The taker's limit price is enforced only on order-book fills. When the router sends the unfilled remainder to the AMM fallback it passes amountOutMin = 0. Any searcher can sandwich the routed portion, buying ahead of it and selling after.

The effect is largest when the book is thin, and it combines with MM-03 (before its fix) and MM-04 to push more volume to the unprotected path.

Worse execution for takers on routed volume; value captured by searchers.

Apply the taker's limit price to the whole order by deriving a minimum output for the remainder, or revert if it cannot be met.

Open.

Order IDs increment globally. Searchers can predict which orders a market maker will cancel from its recent placements and race fills against cancellations. This is common to on-chain order books and mainly affects market makers' execution quality.

Adverse selection for market makers.

Offer a cancel-all-by-nonce function so makers can invalidate quotes in one transaction.

Acknowledged as inherent to the design; a nonce-based cancel-all is under consideration.

Contracts use pragma solidity ^0.8.19 and the listing manager changes listings without events, which complicates monitoring of delistings.

Compiler drift and reduced observability.

Pin the compiler version and emit ListingAdded and ListingRemoved.

Fixed.