ETHCrowdfundBase#_calculateRefundAmount can return too many funds to users and brick refunds

Lines of code Vulnerability details Impact Malicious user can honeypot and grief users causing loss of funds Proof of Concept ETHCrowdfundBase.solL227-L230 if fundingSplitRecipient != address0 && fundingSplitBps 0 uint96 feeAmount = amount fundingSplitBps / 1e4; amount -= feeAmount; When a user...

Overpayment of ETH is not refunded to the buyer

Lines of code Vulnerability details Impact Overpayment of ETH is not refunded to the buyer Proof of Concept ' function executeFundsTransfer address seller, address buyer, address paymentToken, Fee calldata fees, uint256 price internal if msg.sender == buyer && paymentToken == address0...