Summary

In the buyOrder function, there is a logic error in the fee validation. The condition checks if the msg.value is sufficient to cover order.price plus the seller's fee (sellerFee) instead of the total fee (fee). This can lead to a miscalculation and unintended behavior during the transaction.

Vulnerability Details

• The condition msg.value < order.price + sellerFee incorrectly uses sellerFee instead of the full fee.

• Since sellerFee is only half of fee, this condition will not accurately verify that the buyer provided sufficient Ether to cover the price and the entire fee.

Impact

Buyers could successfully submit transactions without paying the full intended fee, potentially leading to a loss of revenue for the contract owner or disrupting the fee-sharing logic.

Tools Used

Menual code review

Recommendations

Update the fee validation logic to compare msg.value against the correct total amount, which includes the full fee rather than the partial sellerFee.