Blur Exchange contest - hansfriese's results

Lines of code

https://github.com/code-423n4/2022-10-blur/blob/2fdaa6e13b544c8c11d1c022a575f16c3a72e3bf/contracts/matchingPolicies/StandardPolicyERC1155.sol#L12-L62

Vulnerability details

Impact

StandardPolicyERC1155.sol doesn't validate the order.amount properly.

This contract is used to check a policy for matching orders of ERC1155 tokens.

But it doesn't check the amount of ERC1155 token properly and traders might lose their funds unexpectedly.

Proof of Concept

As we can see here, order.amount can be greater than 1 for ERC1155 tokens.

But canMatchMakerAsk and canMatchMakerBid don't validate the amounts of buy/sell orders at all and return just 1 as an amount.

So the below scenario is possible.

• A user Alice created a buy order tokenId = ERC1155 tokenId, amount = 10, price = 1 ETH
• After noticing that, Bob created a sell order with the same ERC1155 token with amount = 10, price = 1 ETH
• And Bob executed the orders successfully using execute()
• While checking the policy here, the amount will be 1 always because the functions in StandardPolicyERC1155.sol return 1 here and here.
• So Alice will get 1 ERC1155 token for 1 ETH although she wanted to buy 10 tokens for 1 ETH.

Tools Used

Solidity Visual Developer of VSCode

Recommended Mitigation Steps

We should validate the amount properly and return the correct value with canMatchMakerAsk() and canMatchMakerBid().

function canMatchMakerAsk(Order calldata makerAsk, Order calldata takerBid)
    external
    pure
    override
    returns (
        bool,
        uint256,
        uint256,
        uint256,
        AssetType
    )
{
    return (
        (makerAsk.side != takerBid.side) &&
        (makerAsk.paymentToken == takerBid.paymentToken) &&
        (makerAsk.collection == takerBid.collection) &&
        (makerAsk.tokenId == takerBid.tokenId) &&
        (makerAsk.matchingPolicy == takerBid.matchingPolicy) &&
        (makerAsk.price == takerBid.price) &&
        (makerAsk.amount == takerBid.amount), //++++++++++++++++++++++
        makerAsk.price,
        makerAsk.tokenId,
        makerAsk.amount, //+++++++++++++++++++++++++
        AssetType.ERC1155
    );
}