Submitted by Lambda, also found by gzeon
The purchase function does not require that an NFT is bought for exactly minReservePrices[_poolId] * filledQuantities[_poolId], the price is only not allowed to be greater:
This makes sense because it is not sensible to pay more when the purchase also succeeds with a smaller amount. However, the logic within claim does assume that the NFT was bought for minReservePrices[_poolId]. It decreases from contribution the quantity times the reserve price for all bids:
Only the remaining amount is reimbursed to the user, which can lead to a loss of funds.
Lets say that filledQuantities[_poolId] = 100 and minReservePrices[_poolId] (i.e., the lowest bid) was 1 ETH. However, it was possible to buy the NFT for only 50 ETH. When a user has contributed 20 * 1 ETH, he does not get anything back when calling claim, although only 10 ETH (0.5 ETH * 20) of his contributions were used to buy the NFT. The overall loss of funds for all contributors is 50 ETH.
Set minReservePrices[_poolId] to _price / filledQuantities[_poolId] after a purchase.
stevennevins (Tessera) disagreed with severity and commented:
mehtaculous (Tessera) confirmed
HickupHH3 (judge) commented:
stevennevins (Tessera) commented:
stevennevins (Tessera) mitigated:
Status: Mitigation not confirmed.  Full details in reports from gzeon and  IllIllI. Also included in Mitigation Review section below.
