The MATCH_EXECUTOR can choose tx.gasprice and take the gas cost from a buyer. An executor can make a overly costly tx mined by a friendly miner and take extra profits.
There's no incentive for MATCH_EXECUTOR to use the minimal tx.gasprice.
A solution can be using a Chainlink oracle for gasPrice, but it may be overkill.
Minimal solution is to keep the executor accountable in some way if they abuse their role.
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L739
Vulnerability details
Impact
The
MATCH_EXECUTOR
can choosetx.gasprice
and take the gas cost from a buyer. An executor can make a overly costly tx mined by a friendly miner and take extra profits.Proof of Concept
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L739 and similar functions...
Recommended Mitigation Steps
There's no incentive for
MATCH_EXECUTOR
to use the minimaltx.gasprice
. A solution can be using a Chainlink oracle for gasPrice, but it may be overkill. Minimal solution is to keep the executor accountable in some way if they abuse their role.