Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

In several places in `PreMarkets.sol`, the excess ETH is not refunded to the user and is lost

StraawHaat

Summary

In several places in PreMarkets.sol, the excess ETH is not refunded to the user and is lost

Vulnerability Details

When the user use createOffer(), listOffer(), relistOffer(), and _depositTokenWhenCreateTaker(), he should send ether. From there, it is called tokenManager.tillIn{value: msg.value}:

if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @notice check msg value
* @dev if msg value is less than _amount, revert
* @dev wrap native token and transfer to capital pool
*/
if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);

Here, we can only see if msg.value is sufficient, but there is no check if it is more than the exceeding value is to be returned to the user.

if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);

Impact

The excess ether is lost.

Tools Used

Visual Studio Code

Recommendations

Return the remaining ether to the user.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.