search

code-423n4 / 2022-05-cally-findings

2 stars 0 forks source link

Extra amount sended to buy an option is not returned. #252

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L224 https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L250

Vulnerability details

Impact

A user could send more premium than the option premium to buy the option. That extra amount is not sended back and it's assigned to the option seller.

Proof of Concept

The function buyOption() check if the msg.value is bigger or equal than the premium. If the user by mistake send more than the premium value, the extra amount is not sended back. https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L224 It is assigned to the beneficiary. https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L250

Recommended Mitigation Steps

require that msg.value=premium . Another option would be to send back the funds only if msg.value>premium. The amout to send back would be msg.value - premium.

outdoteth commented 2 years ago

reference issue: https://github.com/code-423n4/2022-05-cally-findings/issues/84