Origami - CowSwapper

The setOrderConfig() function only checks that expiryPeriodSecs is non-zero:

if (config.expiryPeriodSecs == 0) revert CommonEventsAndErrors.ExpectedNonZero();

A value of 1 second is technically valid but impractical. The CoW Swap Watchtower polls every block, so orders with very short expiry periods will expire before they can be detected and executed.

Informational

A minimal value of 5 minutes seems more inline with a reasonable operational window for CoW Swap's infrastructure.

Acknowledged - The check is to ensure the caller has at least set it to something non-zero.

The current post hook gas limit is set to 250,000 gas. Analysis of historical transactions from addresses 0x25dd72cc1de50e963948e464c09aeba0d9312349 and 0xeb32f71b700b75ad6bf84c9b0374f388740c266f using Tenderly shows variable gas consumption based on the stalking contract used in the post hook:

• SPK → USDS swaps: ~60,000 gas
• SKY → SKY swaps: ~165,000 gas

In CoW Swap's fee structure, the full reserved gas amount (250,000) is deducted as a fee regardless of actual consumption, with no refund for unused gas. Overall yield is decreased due to inflated execution costs.

Informational.

Adjust the gas limits for the hooks.

Acknowledged.

OrigamiCowSwapper.setOrderConfig is used by an authorized party to set crucial data to be used when creating an order for a given token. OrigamiSowSwapper.updateAmountsAndAdjustmentBps may be used to update selected, existing order configurations.

When config.limitPriceOracle != address(0), the setOrderConfig() method doesn't verify config.limitPriceAdjustmentBps to be within an expected range, whether within [-100%, 100%] or a stricter one.

Within updateAmountsAndAdjustmentBps(), the same holds: the limitPriceAdjustmentBps is only validated to be non zero if config.limitPriceOracle != address(0).

Informational.

Add validation within both mentioned methods to enforce the highlighted config value is within a selected range.

Updated in PR#1937.