safeTransferFrom arbitrary address

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/core/InfinityExchange.sol#L236-L241

Vulnerability details

description

in InfinityExchange.sol, MATCH_EXECUTOR can call the function matchOneToManyOrders()

the function performs safeTransferFrom from makerOrder.signer which is a function parameter

performing safeTransferFrom from an address other than msg.sender is inherently unsafe as funds could be transferred from an arbitrary address

PoC

/2022-06-infinity/contracts/core/InfinityExchange.sol
236:       if (makerOrder.execParams[1] == weth) {
237:         IERC20(weth).safeTransferFrom(makerOrder.signer, address(this), protocolFee + gasCost);
238:       } else {
239:         IERC20(makerOrder.execParams[1]).safeTransferFrom(makerOrder.signer, address(this), protocolFee);
240:         IERC20(weth).safeTransferFrom(makerOrder.signer, address(this), gasCost);
241:       }

[nneverlander]

Not a bug

[HardlyDifficult]

The attack here is not clear. Closing as invalid.