Putty contest - 0x29A's results

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L561-L584 https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L259-L380 https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L382-L458

Vulnerability details

Impact

In the fillOrder, exercise or acceptCounterOffer functions there are some paths where an user can send value by mistake and the contract dont't use this value and will stuck in the contract

Proof of Concept

In exercise function, exercising a put option order and the sender send value There are others paths with the same effect the the three functions

Tools Used

Review

Recommended Mitigation Steps

Revert the transaction if send mistakenly value:

• L337-L339:

} else {
+       require(msg.value == 0, "The ETH amount sent should be 0");
    ERC20(order.baseAsset).safeTransferFrom(msg.sender, order.maker, order.premium);
}

• L359-L361:

} else {
+       require(msg.value == 0, "The ETH amount sent should be 0");
    ERC20(order.baseAsset).safeTransferFrom(msg.sender, address(this), order.strike);
}

• L435-L437:

} else {
+       require(msg.value == 0, "The ETH amount sent should be 0");
    ERC20(order.baseAsset).safeTransferFrom(msg.sender, address(this), order.strike);
}

Non-critical

[N-01] UNUSED IMPORT

./contracts/src/PuttyV2Nft.sol L5: The import "openzeppelin/utils/Strings.sol"; is unused