Attack surface is pretty low. I can't find anything obvious through fudging with form parameters but I'll keep looking when I have time.

Couple of trivial/minor things:

You can click new multiple times and it makes many rows of the new order form. I thought this was so you could create multiple orders at the same time which I thought was a good feature - However, you can only select one of the radio buttons across the whole set so this looks like a bug. (pic: http://i50.tinypic.com/34so4du.png)
IMO, If you do make this feature there should be a button at the bottom so you can place all the orders at the same time rather than having to click the place order button on each individual row.

Very trivial thing, don't know if it's an actual issue or a conscious decision:
on Signup, the terms and condition link changes the page rather than opens in a popup so I lost the password I had entered when I hit back.
Normally I middle click those links to open them in a new tab but sometimes they are javascript links(to open the t&c in a pop-up) which means that doesn't work. If you do decide to make it a javascript pop-up, leave the link as it is, and use the onclick to open the popup and return false so it doesn't actually change the page. That makes middle click work to open the link as normal, and left click calls the onclick handler to open the popup and cancels the normal link action.

Bitcoin address, if accepted: 1GgQn4VGwv75x2bNweua4Ko34tGvZXjkNj