Blur Exchange contest - 0x52's results

Lines of code

https://github.com/code-423n4/2022-10-blur/blob/2fdaa6e13b544c8c11d1c022a575f16c3a72e3bf/contracts/matchingPolicies/StandardPolicyERC1155.sol#L12-L36 https://github.com/code-423n4/2022-10-blur/blob/2fdaa6e13b544c8c11d1c022a575f16c3a72e3bf/contracts/matchingPolicies/StandardPolicyERC1155.sol#L38-L62

Vulnerability details

Impact

Buyer doesn't receive the proper number of ERC1155 tokens

Proof of Concept

StandardPolicyERC1155#canMatchMakerAsk and canMatchMakerBid always return an amount of 1, instead of the amount of tokens listed in the sell order. This could be abused by listing multiple ERC1155 tokens. Since the buyer is supposed to receive multiple tokens, the order price can be much higher than it would be for a single token. When the order is filled the buyer will only receive 1 token but will have paid for multiple.

Tools Used

Manual Review

Recommended Mitigation Steps

Modify the return value to confirm the amount between orders match and then return the proper amount to be sold:

    return (
        (makerAsk.side != takerBid.side) &&
        (makerAsk.paymentToken == takerBid.paymentToken) &&
        (makerAsk.collection == takerBid.collection) &&
        (makerAsk.tokenId == takerBid.tokenId) &&
        (makerAsk.matchingPolicy == takerBid.matchingPolicy) &&
        (makerAsk.price == takerBid.price) &&
        (makerAsk.amount == takerBid.amount),
        makerAsk.price,
        makerAsk.tokenId,
        makerAsk.amount,
        AssetType.ERC1155
    );