You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Beneficiary is credited additional ETH above premium
The Cally#buyOption function ensures that the caller sends an ETH amount equal to or greater than the calculated premium:
If the caller of buyOption sends excess ETH above the premium amount, this additional amount is credited to the beneficiary.
Recommendation: If this is intentional, clearly document this behavior for end users. If not, consider requiring an exact premium amount rather than accepting additional ETH.
The text was updated successfully, but these errors were encountered:
HardlyDifficult
added
bug
Something isn't working
duplicate
This issue or pull request already exists
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
labels
May 30, 2022
JeeberC4
removed
bug
Something isn't working
duplicate
This issue or pull request already exists
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
labels
Jun 6, 2022
From horsefacts in #294
Beneficiary is credited additional ETH above premium
The Cally#buyOption function ensures that the caller sends an ETH amount equal to or greater than the calculated premium:
buyOption#L224
It then credits the beneficiary with an amount equal to msg.value:
buyOption#L250
If the caller of buyOption sends excess ETH above the premium amount, this additional amount is credited to the beneficiary.
Recommendation: If this is intentional, clearly document this behavior for end users. If not, consider requiring an exact premium amount rather than accepting additional ETH.
The text was updated successfully, but these errors were encountered: