Users don't get refunds when claiming, which allows other users to claim at a discount

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-phi/blob/main/src/PhiFactory.sol#L283
https://github.com/code-423n4/2024-08-phi/blob/main/src/PhiFactory.sol#L300

Vulnerability details

Impact

Users can claim NFTs through the PhiFactory contract by calling claim(...). If a user sends more ETH with the tx than what is needed for the claiming they are supposed to get a refund of the excess ETH. However, that does not happen and the additional ETH gets stuck in the contract. This allows a cautious user to see that and claim at a discount an NFT due to the ETH left in the contract.

Let's say a user claims an NFT via claim(...) and sends an additional 0.01e18 ETH with their call. This means they won't get their excess ETH back and the ETH will be sitting in the contract. That will give the opportunity to another user to claim an NFT with their ETH at a discount.

Proof of Concept

The following lines of code can be added at the very end of the test_claimMerkle() unit test inside the test/PhiFactory.t.sol file:

phiFactory.claim{ value: totalMintFee }(dataCompressed);
assertEq(address(phiFactory).balance, 0);

phiFactory.claim{ value: totalMintFee + 0.01e18 }(dataCompressed);
assertEq(address(phiFactory).balance, 0.01e18);

phiFactory.claim{ value: totalMintFee - 0.01e18 }(dataCompressed);
assertEq(address(phiFactory).balance, 0);

Tools Used

Manual review

Recommended Mitigation Steps

Make sure to properly refund the user when they call claim(...)

Assessed type

Other

[c4-judge]

fatherGoose1 marked the issue as satisfactory

[c4-judge]

fatherGoose1 marked the issue as not a duplicate

[c4-judge]

fatherGoose1 marked the issue as duplicate of #109