OperatorProposal._executeOperation() should refund excess ETH

Lines of code Vulnerability details Impact There are excess ETH in OperatorProposal.executeOperation, and it should be refunded. Proof of Concept OperatorProposal.executeOperation runs data.operator.execute with data.operatorValue of ETH. data.operator.execute value: data.operatorValue...

Exchange's _returnDust() does not validate return value of call() to send excess ETH to sender.

Lines of code Vulnerability details Impact When a caller to Exchange's execute or bulkExecute includes more ETH than is required to complete the transactions, returnDust is intended to return this excess back to the caller. However, returnDust does not validate that the call it performs to return...

LineLib.receiveTokenOrETH() can accept more ETH than it accounts for

Lines of code Vulnerability details Impact LineLib.receiveTokenOrETH can receive ETH and accounts for an amount to receive but it is possible to send more ETH than amount, meaning that any extra ETH sent will be lost to the contract. Proof of Concept LineLib.receiveTokenOrETH is as follows...

User can send an excess of ETH to L1GraphTokenGateway

Lines of code Vulnerability details Impact User can send too much ether into the contract which may get stuck if there is issues with the refund process. Proof of Concept User sends too much ether to outboundTransfer. This is sent to a refund address in Arbitrum. If Arbitrum is compromised or suc...

Upgraded Q -> M from 294 [1654058024144]

Judge has assessed an item in Issue 294 as Medium risk. The relevant finding follows: Beneficiary is credited additional ETH above premium The CallybuyOption function ensures that the caller sends an ETH amount equal to or greater than the calculated premium: buyOptionL224 requiremsg.value =...