Lines of code

Vulnerability details

Impact

There are excess ETH in OperatorProposal._executeOperation, and it should be refunded.

Proof of Concept

OperatorProposal._executeOperation runs data.operator.execute with data.operatorValue of ETH.

    data.operator.execute{ value: data.operatorValue }(data.operatorData, executionData); 

When allowOperatorsToSpendPartyEth is false, it works when data.operatorValue <= msg.value.

        if (!allowOperatorsToSpendPartyEth && data.operatorValue > msg.value) {
            revert NotEnoughEthError(data.operatorValue, msg.value);
        }

So only data.operatorValue will be used out of msg.value when allowOperatorsToSpendPartyEth is false. We should refund the excess amount.

Tools Used

Manual Review

Recommended Mitigation Steps

We should refund msg.value - data.operatorValue when allowOperatorsToSpendPartyEth is false.

The text was updated successfully, but these errors were encountered:

All reactions