The exchange example from the ethereum dapp-bin standardized contract APIs, whose deleteOrder lets anyone cancel anyone else's order.
Context
Deployed 8 September 2015, during the Frontier era.
Key Facts
Description
The exchange contract from the standardized contract APIs directory of the ethereum dapp-bin repository, an order book that escrows one token and settles it against another. placeOrder pulls the offered amount from the caller with sendCoinFrom, records an Order holding the creator, both token addresses and both amounts, and returns the new order id, or zero when the pull fails. claimOrder pulls the wanted amount from the caller to the order creator, sends the escrowed amount to the caller, emits Traded under a currency pair key packed from the top sixteen bytes of each token address, and clears the record. deleteOrder returns the escrowed amount to the order creator and clears the record, and it checks nothing at all: any address can close any open order at any time, and the funds go to the creator rather than to the caller, so the hole is a way to cancel other people's orders rather than to steal from them.
Source Verified
Heuristic Analysis
The following characteristics were detected through bytecode analysis and may not be accurate.
Frontier Era
The initial release of Ethereum. A bare-bones implementation for technical users.
Bytecode Overview
Verified Source Available
Source verified through compiler archaeology and exact bytecode matching.
View Verification ProofShow source code (Solidity)
// Submitted by EthereumHistory (ethereumhistory.com)
contract currency {
function sendCoinFrom(address _from, uint _val, address _to) returns (bool _success) { }
function sendCoin(uint _val, address _to) returns (bool _success) { }
}
contract exchange {
struct Order {
address creator;
address offerCurrency;
uint256 offerValue;
address wantCurrency;
uint256 wantValue;
}
event Traded(bytes32 indexed currencyPair, address indexed seller, uint256 offerValue, address indexed buyer, uint256 wantValue);
mapping ( uint256 => Order ) orders;
uint256 nextOrderId = 1;
function placeOrder(address _offerCurrency, uint256 _offerValue, address _wantCurrency, uint256 _wantValue) returns (uint256 _offerId) {
if (currency(_offerCurrency).sendCoinFrom(msg.sender, _offerValue, this)) {
_offerId = nextOrderId;
nextOrderId += 1;
orders[_offerId].creator = msg.sender;
orders[_offerId].offerCurrency = _offerCurrency;
orders[_offerId].offerValue = _offerValue;
orders[_offerId].wantCurrency = _wantCurrency;
orders[_offerId].wantValue = _wantValue;
}
else _offerId = 0;
}
function claimOrder(uint256 _offerId) returns (bool _success) {
if (currency(orders[_offerId].wantCurrency).sendCoinFrom(msg.sender, orders[_offerId].wantValue, orders[_offerId].creator)) {
currency(orders[_offerId].offerCurrency).sendCoin(orders[_offerId].offerValue, msg.sender);
bytes32 currencyPair = bytes32(((uint256(orders[_offerId].offerCurrency) / 2**32) * 2**128) + (uint256(orders[_offerId].wantCurrency) / 2**32));
Traded(currencyPair, orders[_offerId].creator, orders[_offerId].offerValue, msg.sender, orders[_offerId].wantValue);
orders[_offerId].creator = 0;
orders[_offerId].offerCurrency = 0;
orders[_offerId].offerValue = 0;
orders[_offerId].wantCurrency = 0;
orders[_offerId].wantValue = 0;
_success = true;
}
else _success = false;
}
function deleteOrder(uint256 _offerId) {
currency(orders[_offerId].offerCurrency).sendCoin(orders[_offerId].offerValue, orders[_offerId].creator);
orders[_offerId].creator = 0;
orders[_offerId].offerCurrency = 0;
orders[_offerId].offerValue = 0;
orders[_offerId].wantCurrency = 0;
orders[_offerId].wantValue = 0;
}
}External Links
Related contracts
Multiply7
Same deployerThe canonical Solidity 'multiply by 7' tutorial contract from the Frontier documentation.
0xa18d71...418761August 10, 2015currency
Same deployerAn early Frontier-era token contract implementing a pre-ERC-20 interface, deployed on September 8, 2015 by an address associated with the ENS name collectibletr
0x8494f7...634fd3September 8, 2015MyToken
Same deployerA MyToken template deployment by collectibletrust.eth on November 3, 2015, linking the same deployer responsible for the pre-ERC-20 currency contract from Septe
0x5f100e...12a9e0November 3, 2015