smbv-1923 - Excessive ETH passed during mint() would not be refunded

[sherlock-admin3]

smbv-1923

medium

Excessive ETH passed during mint() would not be refunded

Summary

Excessive ETH passed during mint() would not be refunded

Vulnerability Detail

• When user Mints a new token for the given work and passes excess ETH , the excessive ETH would not be returned resulting in a loss of user's fund.
• When mint() is called all the ETH (i.e msg.value ) would pass into FEE_MANAGER contract . FEE_MANAGER.collectMintFee{value: msg.value}( this, tokenId_, amount_, msg.sender, referrer_, works[tokenId_].strategy );
• So now the excessive ETH is inside FEE_MANAGER contract and FEE_MANAGER contract does not transfer back excessive ETH to Edition contract.
• When _refundExcess() get's called inside mint() at that time the excessive ETH would be inside FEE_MANAGER contract and not inside Edition.sol https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/editions/Edition.sol#L241
• So _refundExcess() would not return excessive ETH passed by user resulting in a loss of user's fund.
• As there will be no ETH inside Edition.sol.

Impact

• Loss of user's fund when excessive ETH has been passed.

  Code Snippet

  https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/editions/Edition.sol#L241 https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/editions/Edition.sol#L512

  Tool used

Manual Review

Recommendation

• Transfer excessive ETH from FEE_MANAGER contract to Edition contract so that excessive ETH can be refunded.

Duplicate of #269

[ShaheenRehman]

Escalate

Dup of #269

[sherlock-admin3]

Escalate

Dup of #269

You've created a valid escalation!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[WangSecurity]

Agree with the escalation, planning to accept and duplicate with #269

[Evert0x]

Result: High Duplicate of #269

[sherlock-admin2]

Escalations have been resolved successfully!

Escalation status:

• ShaheenRehman: accepted