Edition._refundExcess: misimplemented as funds aren't on address(this) but on FEE_MANAGER
Summary
Edition._refundExcess() doesn't work correctly as the excess funds sent from the user are forwarded to the FEE_MANAGER and aren't on the Edition contract anymore.
Vulnerability Detail
The different mint functions on the Edition contract end with a call to _refundExcess().
Its implementations checks that the user sent funds, and sends back any excess stuck in the contract
Therefore address(this).balance doesn't get increased on Edition for the users to claim the stored funds
Impact
Funds are stuck
Users aren't refunded automatically as expected
Users may get freebies (funds that were actually stuck in Edition but aren't rightfully theirs to claim)
An admin-callable withdraw function exist on FeeManager but isn't supposed to be part of this refund process (still, it decreases the severity from High to Medium)
Either move the function to FeeManager and pass the msg.sender's address as a parameter
Or implement a refund mechanism on FeeManager sending back the excess on Edition which will then send back the excess on msg.sender
threadmodeling
medium
Edition._refundExcess
: misimplemented as funds aren't onaddress(this)
but onFEE_MANAGER
Summary
Edition._refundExcess()
doesn't work correctly as the excess funds sent from the user are forwarded to theFEE_MANAGER
and aren't on theEdition
contract anymore.Vulnerability Detail
The different mint functions on the
Edition
contract end with a call to_refundExcess()
.Its implementations checks that the user sent funds, and sends back any excess stuck in the contract
However, the claim here is that funds from
msg.value
are actually all forwarded to theFEE_MANAGER
:If we look at
collectMintFee()
's implementation, it will consume allmsg.value
without refunding anything, even in the even offee_.amount == 0
:Therefore
address(this).balance
doesn't get increased onEdition
for the users to claim the stored fundsImpact
Funds are stuck
Users aren't refunded automatically as expected
Users may get freebies (funds that were actually stuck in
Edition
but aren't rightfully theirs to claim)An admin-callable withdraw function exist on FeeManager but isn't supposed to be part of this refund process (still, it decreases the severity from High to Medium)
Code Snippet
Tool used
Manual Review
Recommendation
Either move the function to
FeeManager
and pass themsg.sender
's address as a parameter Or implement a refund mechanism onFeeManager
sending back the excess onEdition
which will then send back the excess onmsg.sender