New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Critical 2.6 Vulnerability : Order placed even if user doesn't have sufficient funds #3035

Open

devshaaran opened this issue Feb 8, 2022 · 0 comments

devshaaran commented Feb 8, 2022

In case if the user does not have enough funds to buy, the order is still processed.

This bug only occurs when you buy and not when you sell.

peatio/app/models/order.rb

Line 183 in 7df3b8f

raise ::Account::AccountError unless member_balance >= locked

Example :
I have a balance of 2 USDT and I want to buy 1 ETH which costs 3000 USDT. The order is processed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment