Blur Exchange contest - Ch_301's results

Lines of code

https://github.com/code-423n4/2022-10-blur/blob/main/contracts/matchingPolicies/StandardPolicyERC1155.sol#L33 https://github.com/code-423n4/2022-10-blur/blob/main/contracts/matchingPolicies/StandardPolicyERC1155.sol#L59

Vulnerability details

Impact

By using StandardPolicyERC1155.sol as a matchingPolicy for the order. The buyer will transfer an amount of funds ETH or WETH for 2 or more tokens, but he will receive only 1 token.

Proof of Concept

in case the buyer has set Input.Order.amount > 1. Let’s say a buyer set a new order with Input.Order.amount == 2 that is means Input.Order.price will be for two tokens The seller after seeing this order he will create a new sell order for the same ERC115 token And he will invoke execute() and StandardPolicyERC1155.sol will matching this order

           (makerBid.side != takerAsk.side) &&
            (makerBid.paymentToken == takerAsk.paymentToken) &&
            (makerBid.collection == takerAsk.collection) &&
            (makerBid.tokenId == takerAsk.tokenId) &&
            (makerBid.matchingPolicy == takerAsk.matchingPolicy) &&
            (makerBid.price == takerAsk.price),
            makerBid.price,
            makerBid.tokenId,
            1,//here
            AssetType.ERC1155

It will check if (makerBid.price == takerAsk.price) and set the Amount = 1 Without have any check in the original order for Amount

Recommended Mitigation Steps

Add a check if(Input.Order.amount > 1 == true) revert