Dria

Vulnerability Details

• In the purchase() function, each asset is purchased in sequence, and the function checks if the total spending (spendings[round]) exceeds the predefined amountPerRound limit before each purchase. When this limit is exceeded due to the purchase of a specific asset, the entire transaction reverts.

• This behavior effectively cancels all previously successful purchases made during the same transaction, leaving buyer with nothing.

• Instead of revert, could use an error or a break.

• code in question:

Impact

• The reversion behavior results in users being unable to complete any asset purchases if a limit is reached mid-transaction, even if multiple assets were within budget prior to the limit-exceeding asset. This behavior:

• Increases gas costs for users through failed transactions.

• Leads to inefficiencies, as users may be unable to finalize any purchases due to a single limit violation.

Tools Used

• Manual Review

Recommendations

• Avoid Reverting Entire Transaction on Limit Exceedance: Instead of reverting when the spending limit is exceeded, implement a mechanism to gracefully terminate the transaction with an error message, allowing previously successful purchases to remain intact. This will enable users to retain the benefits of their purchases, even if the transaction cannot be completed in full.