SpeedBumpPriceGate.sol has high likelyhood of overcharging buyer during decay phase

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/SpeedBumpPriceGate.sol#L79

Vulnerability details

Impact

Contract overcharges user

Proof of Concept

L79 passes through the entire ether balance sent. Since price decays each block it is likely that the transaction won't be processed during the same block that it was submitted. In situations like this the price at transaction confirmation will be lower (due to decay) than the amount of ether sent

Tools Used

Recommended Mitigation Steps

passThruGate should only take calculated price and should either return excess or allow excess to be claimed using a separate refund function

[illuzen]

duplicate #48

[gititGoro]

User funds lost: increasing severity.