Submission Details
Severity:
Money loss paid by buyer while buying the tokens from seller
Description
While buying tokens from seller money paid by buyer is lost, as there is no checks for amount a buyer should pay in `TokenDivider::buyOrder` function.
Impact
Buyer loss their money while buying the token from seller.
Proof of Concept
Add this code in the `TokenDividerTest` contract
Code:
```javascript
function testUserPaysMoreThenPrice() public nftDivided {
ERC20Mock erc20Mock = ERC20Mock(tokenDivider.getErc20InfoFromNft(address(erc721Mock)).erc20Address);
vm.startPrank(USER);
erc20Mock.approve(address(tokenDivider), AMOUNT);
tokenDivider.sellErc20(address(erc721Mock), 200, AMOUNT);
vm.stopPrank();
address user1 = makeAddr("user1");
vm.deal(user1, 300);
vm.prank(user1);
tokenDivider.buyOrder{value: 201}(0, USER);
console.log("Balance of user1: ", user1.balance);
console.log("Balance of USER: ", USER.balance);
console.log("Balance of user1 Token: ", tokenDivider.getBalanceOf(user1, address(erc20Mock)));
}
```
As code explaines.
1. User wants to sell tokens with price `200`.
2. user1 buy token by paying `201`
But extra `1` amount of money will lost from user1 or buyer as there is no such checks for amount of money pay by buyer.
The final balaces of all the actors will be:
```javascript
Balance of user1: `99`
Balance of USER: `199`
Balance of user1 Token: `2000000000000000000`
```
Recommended Mitigation
Add checks for amount of money paid by buyer weather it is same as price set by seller or not.
Add This checks in the `TokenDivider::buyOrder` function.
```diff
function buyOrder(uint256 orderIndex, address seller) external payable {
if(seller == address(0)) {
revert TokenDivider__InvalidSeller();
}
SellOrder memory order = s_userToSellOrders[seller][orderIndex];
if(msg.value < order.price) {
revert TokenDivider__IncorrectEtherAmount();
}
+ if(msg.value > order.price) {
+ revert TokenDivider__PaidMoreMoneyThenOrderPrice();
+ }
```
Also add this error in `TokenDivider` contract.
```diff
+ error TokenDivider__PaidMoreMoneyThenOrderPrice();
```
Updates
Lead Judging Commences
juan_pedro_ventu 4 months ago
Submission Judgement Published Assigned finding tags:
Token misshandling
The extra eth sent by the user in the buy order will be locked in the contract forever
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.