## Description When placing orders, the creator specifies a ratio, which can be either a custom ratio or a market ratio: [Order Ratio Specification](https://github.com/centrifuge/centrifuge-chain/blob/d26b99e470c56a03cc0e1ba22ce63fa08fadee18/pallets/order-book/src/lib.rs#L426). ```rust ratio: OrderRatio, ``` During order fulfillment, the specific ratio type is checked: [Order Fulfillment](https://github.com/centrifuge/centrifuge-chain/blob/d26b99e470c56a03cc0e1ba22ce63fa08fadee18/pallets/order-book/src/lib.rs#L548-L552). ```rust fn fulfill_order_with_amount() { //snip let ratio = match order.ratio { OrderRatio::Market => Self::market_ratio(order.currency_out, order.currency_in)?, OrderRatio::Custom(ratio) => ratio, }; //snip } ``` However, during investment cancellation, creators lose the ability to set custom ratios and are forced to use the market ratio. For instance, when the currency in the foreign investment differs from the pool currency, a swap is created with a hardcoded `Market ratio`: [Swap Creation](https://github.com/centrifuge/centrifuge-chain/blob/d26b99e470c56a03cc0e1ba22ce63fa08fadee18/pallets/foreign-investments/src/entities.rs#L141-L182). ```rust pub fn create_swap( who: &T::AccountId, swap_id: SwapId, swap: SwapOf, ) -> Result, DispatchError> { if swap.amount_out == Zero::zero() { return Ok(None); } Pallet::::deposit_event(Event::SwapCreatedOrUpdated { who: who.clone(), swap_id, swap: swap.clone(), }); let order_id = T::OrderBook::place_order( who.clone(), swap.currency_in, swap.currency_out, swap.amount_out, OrderRatio::Market, //@audit )?; OrderIdToSwapId::::insert(order_id, (who.clone(), swap_id)); Ok(Some(order_id)) } ``` In the case where the ratio is fetched from the market, it’s obtained via the `market_ratio()` function: [Market Ratio](https://github.com/centrifuge/centrifuge-chain/blob/d26b99e470c56a03cc0e1ba22ce63fa08fadee18/pallets/order-book/src/lib.rs#L632-L641). ```rust pub fn market_ratio( currency_from: T::CurrencyId, currency_to: T::CurrencyId, ) -> Result { let feeder = MarketFeederId::::get()?; T::RatioProvider::get(&feeder, &(currency_from, currency_to))? .ok_or(Error::::MarketRatioNotFound.into()) } ``` This restriction forces creators to accept market ratios during cancellation, which may not be suitable for their use case, especially if they prefer custom ratios. ## Impact 1. **Unacceptable Market Rates:** Creators are forced to accept market rates during cancellation, which in some cases would be unfavorable compared to their desired custom ratios. This easily leads to financial losses or inefficiencies when the rate returned by the Market is not what they'd accept.. 2. **Lack of Flexibility:** By removing the ability to set custom ratios during cancellation, creators lose control over the terms of their investments, potentially leading to less optimal outcomes and dissatisfaction. ## Proof of Concept ### Scenario 1: Unfavorable Market Ratio 1. An investment is created with a custom ratio set by the creator. 2. During cancellation, the system defaults to a market ratio, which is less favorable than the custom ratio. 3. The creator must accept the market ratio, which could result in a loss if the market rate is worse than their custom rate. ### Scenario 2: Loss of Customization 1. A creator initially sets a custom ratio for their investment. 2. Upon cancellation, the creator is forced to use a market ratio instead of their custom ratio. 3. The inability to use the custom ratio may lead to suboptimal cancellation terms and potential dissatisfaction with the process. ## Recommendation Consider allowing the owner of the investment being cancelled to specify a custom ratio if desired. This would ensure that creators can maintain control over the terms of their investments, even when cancelling, and avoid having to accept potentially unfavorable market rates.

Bauchlbred

Public reviews