Loss of Ether Due to Incorrect Handling in createOffer Function
Summary
In the createOffer function, the contract expects Ether to be converted into WETH or another whitelisted token during the creation of an offer. However, the function currently allows users to send both Ether (msg.value) and a whitelisted token simultaneously. This can lead to the Ether being inadvertently lost by the protocol, as it is not properly handled or refunded.
Vulnerability Details
The createOffer function calls TillIn() function located in TokenManager contract which tends to transfer either Eth (by depositing into WETH) or whitelisted token to the capitalPool. However when a whitelisted token is transferred a user can also transfered ETh which is not accounted for.
https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L79-L100
Impact
If a user mistakenly provides both Ether and a whitelisted token when creating an offer, the Ether will not be converted to WETH or used by the protocol, leading to its loss.
1. Call the createOffer function, providing a whitelisted token along with some Ether (msg.value > 0).
2. Observe that the Ether is neither converted to WETH nor refunded, leading to its loss.\
Tools Used
Manual Code Review
Recommendations
There should be a check to prevent ether from being accepted when whitelisted token is used to create offer.
Lead Judging Commences
[invalid] finding-TokenManager-tillin-excess
Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.