code-423n4 / 2021-04-marginswap-findings

1 stars 0 forks source link

function buyBond charges msg.sender twice #38

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Email address

pauliax6@gmail.com

Handle

paulius.eth

Eth address

0x523B5b2Cc58A818667C22c862930B141f85d49DD

Vulnerability details

function buyBond transfers amount from msg.sender twice: Fund(fund()).depositFor(msg.sender, issuer, amount); ... collectToken(issuer, msg.sender, amount);

Impact

This makes the msg.sender pay twice for the same bond.

Recommended mitigation steps

Charge poor man only once.