Submitted by horsefacts, also found by 0x29A, antonttc, berndartmueller, byterocket, cccz, codexploder, dipp, GimelSec, GreyArt, Lambda, oyc109, Ruhum, and unforgiven_
https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L119-L121
https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L1228-L1232
InfinityExchange accepts payments in native ETH, but does not return overpayments to the buyer. Overpayments are likely in the case of auction orders priced in native ETH.
In the case of a Dutch or reverse Dutch auction priced in native ETH, the end user is likely to send more ETH than the final calculated price in order to ensure their transaction succeeds, since price is a function of block.timestamp, and the user cannot predict the timestamp at which their transaction will be included.
In a Dutch auction, final price may decrease below the calculated price at the time the transaction is sent. In a reverse Dutch auction, the price may increase above the calculated price by the time a transaction is included, so the buyer is incentivized to provide additional ETH in case the price rises while their transaction is waiting for inclusion.
The takeOrders and takeMultipleOneOrders functions both check that the buyer has provided an ETH amount greater than or equal to the total price at the time of execution:
InfinityExchange#takeOrders
InfinityExchange#takeMultipleOneOrders
However, neither of these functions refunds the user in the case of overpayment. Instead, overpayment amounts will accrue in the contract balance.
Moreover, since there is a bug in rescueETH that prevents ether withdrawals from InfinityExchange, these overpayments will be locked permanently: the owner cannot withdraw and refund overpayments manually.
Scenario:
Suggestion: Calculate and refund overpayment amounts to callers.
nneverlander (Infinity) confirmed and resolved:
HardlyDifficult (judge) commented:
