Critical 2.6 Vulnerability : Order placed even if user doesn't have sufficient funds

[devshaaran]

In case if the user does not have enough funds to buy, the order is still processed.

This bug only occurs when you buy and not when you sell.

peatio/app/models/order.rb

Line 183 in 7df3b8f

raise ::Account::AccountError unless member_balance >= locked

Example :
I have a balance of 2 USDT and I want to buy 1 ETH which costs 3000 USDT. The order is processed.