Submitted by ravikiranweb3, also found by btk, ether_sky (1, 2), 0xprinc (1, 2), pkqs90, cats, cartlex_, nuthan2x, pep7siup (1, 2), Prathik3, MrPotatoMagic (1, 2), Kose, peanuts, 0xmystery (1, 2), Ephraim, m4ttm, spark, 0xStriker, emrekocak, SanketKogekar, Bjorn_bug, LeoGold, 0xlamide (1, 2), c3phas, imare, PetarTolev, anshujalan, M3azad, spaghetticode_sentinel, Nikki, Timeless, Varun_05, negin, ro1sharkm, Night, tonisives, hihen, Zach_166, kodyvim, cu5t0mpeo, FastChecker, yixxas, Ryonen, nonseodion, ubermensch, Tychai0s, Silvermist, codegpt, grearlake, rouhsamad (1, 2), Cosine, HChang26, _eperezok, 0xblackskull, para8956, 13u9, Kong, dd0x7e8, iamandreiski, ubl4nk (1, 2), pipidu83, mahdirostami, merlinboii, dopeflamingo, oreztker, osmanozdemir1, sl1, DarkTower, Kaysoft, UbiquitousComputing, zhaojohnson, 0xSwahili, eeshenggoh, dimulski, SovaSlava, BowTiedOriole, developerjordy, zaevlad, Lef, KmanOfficial, latt1ce, KupiaSec, jasonxiale, hals (1, 2), Mwendwa, aslanbek, ke1caM, ZanyBonzy, EV_om, cccz, bronze_pickaxe, Oxsadeeq, ktg, twcctop, deepplus, Inference, Soliditors, lil_eth (1, 2), Mylifechangefast_eth, AlexCzm, haxatron, and alexbabits
https://github.com/code-423n4/2024-01-curves/blob/516aedb7b9a8d341d0d2666c23780d2bd8a9a600/contracts/Curves.sol#L211-L216 
https://github.com/code-423n4/2024-01-curves/blob/516aedb7b9a8d341d0d2666c23780d2bd8a9a600/contracts/Curves.sol#L263-L280
In the buyCurvesToken(), the logic check for the msg.value to be greater than price + fees. This is fine, since if the price moves after the estimates was provided to the user, the above validation checks if the funds received are sufficient to proceed with the transaction.
But, at the same time, it is equally important to refund any excess eth received which is not being done.
Refer to the below code where the validation ensures that msg.value is not less than price + total fee.
But, incase any additional funds were received, the same should be returned back to the caller.
uint256 excess = msg.value - (price + totalFee);
if excess > 0,
refund the amount back to the caller.
andresaiello (Curves) confirmed, but disagreed with severity and commented:
alcueca (Judge) decreased severity to Medium
