Blur Exchange contest - Nyx's results

Lines of code

https://github.com/code-423n4/2022-10-blur/blob/2fdaa6e13b544c8c11d1c022a575f16c3a72e3bf/contracts/BlurExchange.sol#L128-L175

Vulnerability details

Impact

Assuming there is a user who tries to buy two tokens with the same tokenId(ERC1155). After executing, the seller gets all the funds, but the buyer only takes one token.

Proof of Concept

it("testing multiple erc1155 ", async () => {
      await mockERC1155.mint(alice.address, tokenId, 2);
      expect(await mockERC1155.balanceOf(alice.address, tokenId)).to.be.equal(
        2
      );
      sell = generateOrder(alice, {
        side: Side.Sell,
        tokenId,
        amount: 2,
        price: anotherPrice, // eth("2");
        collection: mockERC1155.address,
        matchingPolicy: matchingPolicies.standardPolicyERC1155.address,
      });
      buy = generateOrder(bob, {
        side: Side.Buy,
        tokenId,
        amount: 2,
        collection: mockERC1155.address,
        price: anotherPrice, // eth("2");
        matchingPolicy: matchingPolicies.standardPolicyERC1155.address,
      });
      sellInput = await sell.pack();
      buyInput = await buy.pack();

      fee = anotherPrice.mul(feeRate).div(INVERSE_BASIS_POINT);
      priceMinusFee = anotherPrice.sub(fee);

      await waitForTx(exchange.execute(sellInput, buyInput));

      expect(await mockERC1155.balanceOf(bob.address, tokenId)).to.be.equal(1);
      expect(await mockERC1155.balanceOf(alice.address, tokenId)).to.be.equal(
        1
      );
      await checkBalances(
        aliceBalance,
        aliceBalanceWeth.add(priceMinusFee),
        bobBalance,
        bobBalanceWeth.sub(anotherPrice),
        feeRecipientBalance,
        feeRecipientBalanceWeth.add(fee)
      );
    });