Blur Exchange contest - 8olidity's results

Lines of code

https://github.com/code-423n4/2022-10-blur/blob/HEAD/contracts/matchingPolicies/StandardPolicyERC1155.sol#L33 https://github.com/code-423n4/2022-10-blur/blob/HEAD/contracts/matchingPolicies/StandardPolicyERC1155.sol#L59

Vulnerability details

Impact

The tokenid in ERC1155 may have many tokens, but the amount in _canMatchOrders() is a constant,As a result, only one ERC1155 token can be passed each time, which is inconsistent with the design of amount

Proof of Concept

    function canMatchMakerAsk(Order calldata makerAsk, Order calldata takerBid)
        external
        pure
        override
        returns (
            bool,
            uint256,
            uint256,
            uint256,
            AssetType
        )
    {
        return (
            (makerAsk.side != takerBid.side) &&
            (makerAsk.paymentToken == takerBid.paymentToken) &&
            (makerAsk.collection == takerBid.collection) &&
            (makerAsk.tokenId == takerBid.tokenId) &&
            (makerAsk.matchingPolicy == takerBid.matchingPolicy) &&
            (makerAsk.price == takerBid.price),
            makerAsk.price,
            makerAsk.tokenId,
            1,
            AssetType.ERC1155
        );

Tools Used

vscode

Recommended Mitigation Steps

The number of tokens can be defined by users