Skip to content

Partner must send more ETH than needed#

Low Risk

Each canvas can have "partners". These are addresses that have a discount on tokens that they purchase. In Minting.sol there is handleFunds function that handles the distribution of funds for a given sale. We can see on line 463, that if the buyer is a partner and the sale is in ETH, he is returned the amount of ETH that he is discounted for. This means that if a partner has 30% discount, he must send 1 ETH when buying even if it costs him only 0.7 ETH. He will receive the 0.3 ETH back, but it can be inconvenient.

if (canvas.saleToken == address(0)) {
    if (!canvas.refundableDutch) {
        if (protocolFee > 0) sendETH(ds.contractInfo.protocolFeeRecipient, protocolFee);
        if (partnerFee > 0) sendETH(msgSender, partnerFee);
        sendETH(ds.canvas[canvasId].feeRecipient, remainder);
    }

    uint256 excessAmount = ethValue.sub(totalPrice);
    if (excessAmount > 0) sendETH(msgSender, excessAmount);
} 

Recommendation#

Allow partners to send the amount of ETH needed for purchase without requiring the full price. Only send back ETH that exceeds the required amount.

if (canvas.saleToken == address(0)) {
    uint256 excessAmount = ethValue - protocolFee - remainder;

    if (!canvas.refundableDutch) {
        if (protocolFee > 0) sendETH(ds.contractInfo.protocolFeeRecipient, protocolFee);
        sendETH(ds.canvas[canvasId].feeRecipient, remainder);
    } else {
        excessAmount -= partnerFee;
    }

    if (excessAmount > 0) sendETH(msgSender, excessAmount);
}