Submission Details
Severity:
The `TokenDivider::buyOrder` function transfer a `fee` amount to the owner instead of `sellerFee`, either causing the transaction to revert or deduct more ETH from the users than expected
Description
In TokenDivider::buyOrder the owner gets send an amount of fee instead of sellerFee. As fee is only used to calculate the sellerFee variable, and not intended to be transferred.
Impact
If a user calling this function sends a msg.value greater than order.price + fee it will be losing a greater amount of ETH than expected. If the msg.value is less, then the transaction will revert as there is not enough ETH to transfer.
Proof of Concepts
Tools Used
Manual analysis
Recommended mitigation
Add the following changes to the contract:
function buyOrder(uint256 orderIndex, address seller) external payable {
if(seller == address(0)) {
revert TokenDivider__InvalidSeller();
}
SellOrder memory order = s_userToSellOrders[seller][orderIndex];
if(msg.value < order.price) {
revert TokenDivider__IncorrectEtherAmount();
}
uint256 fee = order.price / 100;
uint256 sellerFee = fee / 2;
if(msg.value < order.price + sellerFee) {
revert TokenDivider__InsuficientEtherForFees();
}
balances[msg.sender][order.erc20Address] += order.amount;
s_userToSellOrders[seller][orderIndex] = s_userToSellOrders[seller][s_userToSellOrders[seller].length - 1];
s_userToSellOrders[seller].pop();
emit OrderSelled(msg.sender, order.price);
// Transfer The Ether
(bool success, ) = payable(order.seller).call{value: (order.price - sellerFee)}("");
if(!success) {
revert TokenDivider__TransferFailed();
}
(bool taxSuccess, ) = payable(owner()).call{value: fee}("");
if(!taxSuccess) {
revert TokenDivider__TransferFailed();
}
IERC20(order.erc20Address).transfer(msg.sender, order.amount);
}
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.