Submitted by Ruhum, also found by 0xf15ers, 0xsanson, antonttc, kenzo, and WatchPug
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L149
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L202
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L273
The way the gas refunds are computed in the InfinityExchange contract, the first orders pay less than the latter ones. This causes a loss of funds for the buyers whose orders came last in the batch.
The issue is that the startGasPerOrder variable is computed within the for-loop. That causes the first iterations to be lower than later ones.
Heres an example for the following line: https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L202
To make the math easy we use the following values:
For the 2nd order we then get:
For the 9th order we get:
The startGasPerOrder variable is passed through a couple of functions without any modification until it reaches a line like this: https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/core/InfinityExchange.sol#L231
There, the actual gas costs for the user are computed.
In our case, that would be:
So the 2nd orders buyer pays 162,000 while the 9th orders buyer pays 232,000.
As I said the math was dumbed down a bit to make it easier. The actual difference might not be as big as shown here. But, there is a difference.
The startGasPerOrder variable should be initialized outside the for-loop.
nneverlander (Infinity) confirmed and resolved:
HardlyDifficult (judge) decreased severity to Medium and commented:
