Submission Details
Severity:
No Refund Mechanism for Excess Ether in buyBox function
Description
If users send more Ether than the boxPrice, the transaction reverts.
require(msg.value == boxPrice, "Incorrect ETH sent");
Impact
User Inconvenience: Transactions fail unnecessarily.
Poor User Experience: Users may be confused about the failure.
Recommendations
Allow for excess Ether and refund the difference:
require(msg.value >= boxPrice, "Not enough ETH sent");
uint256 excess = msg.value - boxPrice;
if (excess > 0) {
(bool refundSuccess,) = msg.sender.call{value: excess}("");
require(refundSuccess, "Refund failed");
}
boxesOwned[msg.sender] += 1;
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.