Tadle

Summary

The tillIn function in the TokenManager contract has a critical issue where excess ETH sent with a transaction is permanently locked in the contract without any mechanism for refund or recovery. This issue can lead to significant losses for users who mistakenly send more ETH than required. The function only checks if msg.value is less than _amount, but does not handle cases where msg.value is greater, resulting in excess ETH being trapped in the contract.

Vulnerability Details

The tillIn function allows users to deposit native tokens (ETH) or ERC20 tokens into the contract. For native tokens, the function checks if msg.value is less than _amount and reverts if it is, ensuring that users provide enough ETH for the deposit. However, there are several key issues:

1. Excess ETH Locking: The function does not check if msg.value is greater than _amount, which means any excess ETH sent with the transaction is locked in the contract. The excess amount is not returned to the sender, nor is there a mechanism to withdraw it.

2. No Refund Mechanism: Once excess ETH is sent to the contract, it is unrecoverable, leading to a potential loss of funds. Users have no way to retrieve the locked ETH, which could result in significant financial losses, especially if large amounts are mistakenly sent.

3. ERC20 Transactions: For ERC20 token transactions, any ETH sent with the transaction is also locked in the contract. Although the function correctly handles the transfer of ERC20 tokens, it does not account for any ETH sent alongside the transaction, leading to potential value loss.

Impact

The function tillIn is called for exampe in the function listOffer that takes in argument the _amount but call tillIn with transferAmount this means that the possibilty that msg.value is over transferAmount is not low. for a premarket with high trading volume, this will result in a significant amount of tokens locked overtime.

Tools Used

Manual Review

Recommendations

Refund Excess ETH: Add a mechanism to refund any excess ETH back to the sender. This can be achieved by subtracting _amount from msg.value and transferring the difference back to the sender while respecting CEI to avoid any reentrancy issues.