Six contracts that pass EXTCODESIZE(owner) > 0 and still withdraw their order
On an order book, the depth you see is a promise. The market maker showing you a bid can pull it in the same block you try to take it, and nothing on the screen tells you in advance which levels will hold. On-chain books make that answerable in a way no off-chain exchange can. A resting order has an Order.owner field, and that field is readable by anyone. So if the owner is a contract with no…
On-chain order books offer a transparent view of market depth, but resting orders can pose a risk when owned by contracts without cancellation capabilities. This concern led to the development of six contracts designed to pass the EXTCODESIZE(owner) check, while still enabling order withdrawal. These contracts exploit the fact that EXTCODESIZE merely confirms code existence, without revealing the contract's behavior.
The core issue lies in the classifier's reliance on the size of the owner's code, which provides an unreliable signal. Six methods were employed to demonstrate that a firm depth can still be withdrawn despite passing the check:
1. The first contract hides the cancellation function behind a named method called poke(), which cancels the resting order directly.
2. The second contract employs an upgradeable proxy with an ERC-1967 proxy pattern that temporarily enables cancellation functionality before swapping to a new proxy.
3. The third contract utilizes DELEGATECALL to borrow cancellation functionality from an attacker-controlled target.
4. The fourth contract grants an operator after resting, allowing a separate wallet to cancel the order outside the contract's bytecode.
5. The fifth contract reduces the order's remaining quantity instead of canceling it, effectively shrinking the advertised depth.
6. The sixth contract utilizes multiple cancel selectors, preventing the naive classifier from detecting a cancellation capability.
All six contracts were deployed on the Somnia testnet and successfully executed their respective escapes as real transactions. Four contracts completed a full withdrawal, while two were prevented from doing so due to specific checks in the pool's implementation. The solution to this problem lies in verifying the exact bytecode of the owner's contract instead of merely checking the size.
Using EXTCODEHASH (EIP-1052), a keccak-256 commitment to the bytecode, allows for a more reliable assessment of the contract's capabilities. By classifying orders based on the attested EXTCODEHASH and its inclusion within a predefined lock window, the risk of false positives is significantly reduced. This approach ensures that only verified and scrutinized contracts are granted the status of "FIRM," while others remain in the "UNVERIFIED" category, preventing unreliable liquidity from being laundered through the depth metric.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
