Prevent users from sending more ETH than the premium price in buyOption()

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-cally/blob/main/contracts/src/Cally.sol#L224

Vulnerability details

When calling buyOption(), if a buyer accidentally sends more ETH than the premium price, only the current vault beneficiary would be able to withdraw the additional funds. The buyer or owner has no way of recovering the lost funds.

Proof of Concept

buyOption() checks if the amount of ETH sent by the buyer is equal or larger than the premium price:

Cally.sol:224           require(msg.value >= premium, "Incorrect ETH amount sent");

All of the funds is then directly added to the balance of the current vault beneficiary. Cally.sol:248-250:

// increment vault beneficiary's unclaimed premiums
address beneficiary = getVaultBeneficiary(vaultId);
ethBalance[beneficiary] += msg.value;

Only the beneficiary is able to withdraw the amount added to his ethBalance. Thus, only he can recover the additional funds mistakenly sent by the buyer.

Recommended Mitigation Steps

Consider changing >= to == in buyOption():

Cally.sol:224           require(msg.value >= premium, "Incorrect ETH amount sent");

This is more logical, especially since premium is derived from fixed values in premiumOptions[].

Furthermore, it helps to maintain consistency with the check in exercise():

Cally.sol:272           require(msg.value == vault.currentStrike, "Incorrect ETH sent for strike");

[HardlyDifficult]

Dupe of #84