Closed code423n4 closed 2 years ago
Duplicate of #244 (extra ether not returned) and #346 (ether might be sent along with erc20)
Duping to https://github.com/code-423n4/2022-06-infinity-findings/issues/346
It does also touch on https://github.com/code-423n4/2022-06-infinity-findings/issues/244 but the impact/poc/rec wasn't fully explored for that issue.
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L361-L363
Vulnerability details
Impact
In
takeOrders
, msg.sender can pay the items in ether (or other native coins).However the extra payment isn't returned to the caller. This can be a risk considering that they may send extra for items with "moving" price. Also they may mistakenly send ether to the contract when it's not needed. Indeed the function doesn't revert in that case.
Proof of Concept
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L361-L363
Recommended Mitigation Steps
Add a
else
with arequire(msg.value==0)
. Also consider returning any extra value to msg.sender.