The TokenManager.tillIn
function does not refund over received native tokens to users and this leads the loss of funds for users.
The TokenManager.tillIn
function checks amount of received native tokens is not less than _amount
.
After checking, it deposits _amount
native tokens, but it does not refund msg.value - _amount
native tokens.
This leads the loss of funds for users.
Manual Review
Add the refund mechanism.
Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.