Submission Details
Impact:
Likelihood:
Strict ETH Matching in buyPass Inflexible to User Errors
Root + Impact
Description
The
buyPassfunction requires an exact ETH payment via:
require(msg.value == passPrice[collectionId], "Incorrect payment amount");
If a user overpays (e.g., via miscalculated gas or frontend error), the transaction reverts and funds are stuck.
Risk
Likelihood
Common with wallets that estimate poorly.
Frontends may round ETH inaccurately.
Impact
Users blocked from purchase.
Poor UX and potential lost opportunities.
Proof of Concept
// User pays 0.1001 ETH, expected is 0.1 ETH
buyPass{value: 0.1001 ether}(VIP_PASS); // reverts
Recommended Mitigation
- require(msg.value == passPrice[collectionId], "Incorrect payment amount");
+ require(msg.value >= passPrice[collectionId], "Insufficient payment");
+ uint256 refund = msg.value - passPrice[collectionId];
+ if (refund > 0) {
+ payable(msg.sender).transfer(refund);
+ }
#Allow overpayment and refund the difference
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.