Orderly Network

Smart contracts on the Near blockchain are deployed in accounts backed by regular key pairs. Therefore, the overall security of a smart contract is related to the proper use and safekeeping of such key pairs. Trading users deposit a wide range of assets used for trading into the `Asset Manager` contract. As a result, the contract locks up a significant amount of funds. Therefore, any compromise of the `Asset Manager` contract account could allow a hacker to use this power to steal funds that would otherwise remain in the custody of the contract. Further, the following roles are also sensitive as they contain significant authority over core functionality. In the file, `[contract.rs]`, the role `[fee_collector]` has authority over the following functions: - `fee_collector_withdraw()` In the file, `[owner.rs]`, the role `[owner]` has authority over the following functions: - `set_approver_request_possible()` - `set_approver()` - `set_owner()` - `set_operator_manager()` - `set_only_authorized_access()` - `add_authorized_account()` - `remove_authorized_account()` - `set_withdraw_verify_key()` - `set_trade_verify_key()` - `set_symbol_listed()` - `set_token_listed()` - `set_token_delisted()` - `remove_listed_symbol()` - `set_fee_collector()` In the file, `[Operator.rs]` the role, `[operator]` has authority over the following functions: - `operator_execute_action()` - this allows for privileged access to uploading trades or operator withdrawing. In the file, `[Approver.rs]` the role `[approver]` has authority over the following functions: - `approve_owner()` - `approve_operator()` - `approve_fee_collector()` - `approve_new_approver()` - `approve_approver_request_persmission()` - `approve_symbol_listing()` - `approve_symbol_delisting()` - `approve_token_listing()` - `approve_token_delisting()` - `approve_withdraw_verify_key()` - `approve_trade_verify_key()` - `approve_autorized_access()`

The role `operator manager` account is responsible for uploading trades generated by the off-chain matching engine program. The structure `TradeUpload` in `types.rs` is used to store the information about the uploaded trades. For the information present in the contracts, the field `trade_id` identifies a unique trade. There is no restriction in the code that prevents the same trade from being uploaded more than once. Therefore, the balance of the user in the "Asset Management" contract will be increased/decreased multiple times for the same single trade.