Submitted by KIntern, also found by csanuragjain, GimelSec, kenzo, and unforgiven
Function matchOrders uses custom constraints to make the matching more flexible, allow seller/buyer to specify maximum/minimum number of NFTs they want to sell/buy. This function first does some checks and then execute matching.
But in function areNumItemsValid(), there is a wrong checking will lead to wrong logic in matchOrders() function.
Instead of checking if numConstructedItems <= sell.constraints[0] or not, function areNumItemsValid() check if buy.constraints[0] <= sell.constraints[0]. It will lead to the scenario that numConstructedItems > sell.constraints[0] and make the seller sell more number of nfts than he/she allow.
Consider the scenario
For more information, please check this PoC.
https://gist.github.com/minhquanym/a95c8652de8431c5d1d24aa4076a1878
Hardhat, Chai
Replace check buy.constraints[0] <= sell.constraints[0] with numConstructedItems <= sell.constraints[0]
nneverlander (Infinity) confirmed
HardlyDifficult (judge) commented:
