Submitted by dipp, also found by 0x4non, 0x52, 0xc0ffEE, 0xRobocop, 8olidity, arcoun, aviggiano, bardamu, Ch_301, cryptonue, csanuragjain, d3e4, enckrish, exd0tpy, hansfriese, jayphbee, Jeiwan, joestakey, Junnon, KIntern_NA, ladboy233, Lambda, M4TZ1P, MiloTruck, minhquanym, minhtrng, nicobevi, Nyx, obront, PaludoX0, polymorphism, rokinot, romand, rotcivegaf, Ruhum, RustyRabbit, rvierdiiev, saian, serial-coder, Soosh, TomJ, Trust, trustindistrust, and zzykxx
StandardPolicyERC1155.sol#L12-L36
BlurExchange.sol#L154-L161
The canMatchMakerAsk and canMatchMakerBid functions in StandardPolicyERC1155.sol will only return 1 as the amount instead of the order.amount value. This value is then used in the _executeTokenTransfer call during the execution flow and leads to only 1 ERC1155 token being sent. A buyer matching an ERC1155 order wih amount > 1 would expect to receive amount of tokens if they pay the orders price. The seller, who might also expect more than 1 tokens to be sent, would have set the orders price to be for the amount of tokens and not just for 1 token.
The buyer would lose overspent ETH/WETH to the seller without receiving all tokens as specified in the order.
StandardPolicyERC1155.sol:canMatchMakerAsk
The code above shows that canMatchMakerAsk only returns 1 as the amount. _executeTokenTransfer will then call the executionDelegates transferERC1155 function with only amount 1, transferring only 1 token to the buyer.
Test code added to execution.test.ts:
The test code above shows a sell order for an ERC1155 token with amount = 10 and a matching buy order. The execute function in BlurExchange.sol is called and the orders are matched but the buyer (bob) only receives 1 token instead of 10 despite paying the full price.
Policies used for ERC1155 tokens should return and consider the amount of tokens set for the order.
blur-io-toad (Blur) acknowledged and commented:
Alex the Entreprenerd (Judge) commented:
Alex the Entreprenerd (Judge) commented:
