Submitted by 0xliumin
NestedFactory.sol#L446
A user can destroy their NFTs and not pay fees on most of their assets.
Alice has an NFT portfolio with 100 gwei dai and 100 gwei uni. Alice calls destroy on this NFT with buy token marked as dai. We would expect after this destroy step that she would pay 1 gwei dai in fees + 1 gwei uni worth of dai in fees, no matter what orders she selects.
Alice selects the following orders:
This set of orders doesnt violate any of the require statements in the destroy function. Each order will complete successfully given the constraints here: MixinOperatorResolver.sol#L100-L101.
Fees arent collected on the leftover amount from the callOperator step, seen here: NestedFactory.sol#L446.
This means that Alice will only pay the fees on the dai that was output from the orders (a very small amount), and the rest of the 100 gwei uni and 100 gwei dai are transferred directly back to the attacker.
Replace the safeTransfer with your safeTransferWithFees function.
Or, if you dont want users to have to pay fees on slippage, set a maximum slippage amount in the safeSubmitOrder function.
maximebrugel (Nested Finance) confirmed, but disagreed with High severity and commented:
harleythedog (judge) decreased severity to Medium and commented:
