FixedPricePassThruGate locked ether

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/FixedPricePassThruGate.sol#L48
https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/FixedPricePassThruGate.sol#L53

Vulnerability details

Impact

Contract FixedPricePassThruGate is a pass thru gate that is passing funds to the gate's beneficiary. Function passThruGate requires to send ether that is equal or more than gate.ethCost. In the case of receiving more ether than gate.ethCost, passThruGate passes to the beneficiary only amount of gate.ethCost:

(bool sent, bytes memory data) = gate.beneficiary.call{value: gate.ethCost}("");

Since there is no way to withdraw ether it ends up with ether being locked forever in the contract and effectively loss of funds for the user(s).

Proof of Concept

FixedPricePassThruGate.sol:

• https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/FixedPricePassThruGate.sol#L48
• https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/FixedPricePassThruGate.sol#L53

Tools Used

Manual Review / VSCode

Recommended Mitigation Steps

It is recommended to either pass msg.value to beneficiary:

(bool sent, bytes memory data) = gate.beneficiary.call{value: msg.value}("");

or make sure that exact amount of ether is sent:

require(msg.value == gate.ethCost, 'Please send exact amount of ETH');

[illuzen]

Duplicate #49

[gititGoro]

Upgraded severity: lost user funds.

[gititGoro]

Duplicate of #48