Pieces Protocol

Summary

In the buyOrder function of the TokenDivider contract, the validation for msg.value checks only the seller's portion of the fee (sellerFee) but fails to account for the full platform fee (fee). This oversight could lead to insufficient fees being sent for proper distribution between the seller and the contract owner, resulting in unexpected behavior or failed transactions.

Vulnerability Details

The buyOrder function performs the following key actions:

1. Validates that the buyer sends enough Ether to cover the price of the order and the seller's portion of the fee (sellerFee).

2. Distributes Ether between the seller (order.seller) and the contract owner (owner()).

The issue lies in this part of the code:

https://github.com/Cyfrin/2025-01-pieces-protocol/blob/4ef5e96fced27334f2a62e388a8a377f97a7f8cb/src/TokenDivider.sol#L278-L280

This validation only ensures that the buyer covers the order price and the seller's portion of the fee (sellerFee). It does not include the full fee, which consists of both sellerFee and the remaining platform fee sent to the owner(). As a result:

• The buyer could send less Ether than required to cover the full distribution.

• The taxSuccess transfer to owner() might fail due to insufficient funds.

Impact

The transfer to owner() could fail, leading to unclaimed platform fees.

Tools Used

• Manual code review

Recommendations

To resolve this issue:

Update the fee validation to include the entire platform fee: