Surplus ETH Sent to `TokenDivider::buyOrder` Becomes Irretrievable Due to Lack of Reimbursement Mechanism
Vulnerability Details
TokenDivider::buyOrder is called by users to purchase an order from a seller, and users must set a msg.value according to the price of the sell order they wish to buy. However, there is no mechanism to reimburse any surplus ETH sent if msg.value > order.price + sellerFee.
Impact
Loss of ETH for users, with the surplus ETH becoming stuck in the contract due to the absence of a withdrawal function.
Recommendations
Revert the transaction if msg.value > order.price + sellerFee, or implement a mechanism to reimburse users in the event of a surplus msg.value.
Lead Judging Commences
Token misshandling
The extra eth sent by the user in the buy order will be locked in the contract forever
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.