Option buys do not refund or reject over-payments

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L224

Vulnerability details

Impact

Buyers are over-charged if they send too much in order to try to make the payment not revert due to the dutch auction's price decrease schedule

Proof of Concept

The buyOption() function uses >= rather than ==, and does not refund excess:

File: contracts/src/Cally.sol   #X

224           require(msg.value >= premium, "Incorrect ETH amount sent");

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L224

Incorrect amounts are rejected when payments are made for exercises, so at the very least things are inconsistent:

File: contracts/src/Cally.sol   #X

271           // check correct ETH amount was sent to pay the strike
272           require(msg.value == vault.currentStrike, "Incorrect ETH sent for strike");

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L271-L272

Tools Used

Code inspection

Recommended Mitigation Steps

Reject amounts over the actual price, or refund the excess

[outdoteth]

#84