Submission Details
Severity:
buyer's ETH is losing during buyOrder
Summary
While buying order, if the buyer is paying with over the price, he should lose some ETH.
Vulnerability Details
in buyOrder()there is no checking part for over ETH pay.
If the user occurs the tx with the greater ETH amount than the order price, he lose the msg.value - order.price amount of ETH.
function buyOrder(uint256 orderIndex, address seller) external payable {
if(seller == address(0)) {
revert TokenDivider\_\_InvalidSeller();
}
SellOrder memory order = s_userToSellOrders[seller][orderIndex];
if(msg.value < order.price) {
revert TokenDivider__IncorrectEtherAmount();
}
uint256 fee = order.price / 100;
uint256 sellerFee = fee / 2;
// check the ETH value but there is no check ETH is greater than order price
if(msg.value < order.price + sellerFee) {
revert TokenDivider__InsuficientEtherForFees();
}
balances[msg.sender][order.erc20Address] += order.amount;
s_userToSellOrders[seller][orderIndex] = s_userToSellOrders[seller][s_userToSellOrders[seller].length - 1];
s_userToSellOrders[seller].pop();
emit OrderSelled(msg.sender, order.price);
// Transfer The Ether
// regarding the order price
(bool success, ) = payable(order.seller).call{value: (order.price - sellerFee)}("");
if(!success) {
revert TokenDivider__TransferFailed();
}
(bool taxSuccess, ) = payable(owner()).call{value: fee}("");
if(!taxSuccess) {
revert TokenDivider__TransferFailed();
}
IERC20(order.erc20Address).transfer(msg.sender, order.amount);
}
Impact
The buyers could lose the ETH
Tools Used
Manual Review
Recommendations
you should insert the code snippet for checking the msg.value
// if(msg.value < order.price + sellerFee) {
if (msg.value != order.price + sellerFee)
revert TokenDivider__InsuficientEtherForFees();
}
Updates
Lead Judging Commences
fishy 5 months ago
Submission Judgement Published Assigned finding tags:
Token misshandling
The extra eth sent by the user in the buy order will be locked in the contract forever
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.