Blur Exchange contest - codexploder's results

Lines of code

https://github.com/code-423n4/2022-11-non-fungible/blob/main/contracts/Exchange.sol#L215

Vulnerability details

Impact

If caller calling the execute function is a contract then it is possible that contract is not refunded the excess ETH passed. This happens since the return value for call is not validated

Proof of Concept

1. User calls the execute function which post execution calls _returnDust function

function execute(Input calldata sell, Input calldata buy)
        external
        payable
        whenOpen
        setupExecution
    {
        _execute(sell, buy);
        _returnDust();
    }

2. As we can see the output of call callStatus is not validated and even if the call fails then also _returnDust will pass (User wont get any amount)

function _returnDust() private {
        uint256 _remainingETH = remainingETH;
        assembly {
            if gt(_remainingETH, 0) {
                let callStatus := call(
                    gas(),
                    caller(),
                    selfbalance(),
                    0,
                    0,
                    0,
                    0
                )
            }
        }
    }

Recommended Mitigation Steps

In _returnDust function check that callStatus is true