Anyone can get stuck ETH and ERC20

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-looksrare/blob/e3b2c053f722b0ca2dce3a3eb06f64859b8b7a6f/contracts/LooksRareAggregator.sol#L108-L109

Vulnerability details

Description

LooksRareAggregator.execute() at the end of execution send all unspent ETH and ERC20 back to actor. But it send all amount lying on the contract which may be bigger than initially sent by actor. So anyone seeing that there are some ETH or ERC20 tokens stuck on contract may just send with a call of ERC20EnabledLooksRareAggregator.execute() 1 token of each ERC20 with positive contract balance, some dummy trade order (which may fail) and isAtomic=false flag and get back all funds on contract in ETH and ERC20.
There are special functions to rescue stuck ETH and ERC20 (TokenRescuer.rescueERC20() and TokenRescuer.rescueETH()) which can be called only by owner. So obviously by business-logic anyone shouldn't be able to get stuck ETH and ERC20.

Recommendation

Save initial amount and spent amount of ETH and ERC20 during fulfillment of all orders. Return only unused part of initially sent funds.

[c4-judge]

Picodes marked the issue as duplicate of #277

[c4-judge]

Picodes changed the severity to 2 (Med Risk)

[c4-judge]

Picodes marked the issue as satisfactory