# Passing multiple ETH deposits in orders array will use the same msg.value many times

Batching multiple ETH deposit orders in one call reuses the same msg.value, crediting more ETH than actually sent, up to contract holdings.

- Payout: Audit contest
- Severity: medium
- Program: Nested Finance
- Found by: hyh
- Disclosed: 2021-01-12
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-nested-findings/issues/226
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-nested%3AM-08
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** NestedFactory.sol submitInOrders/submitOutOrders transferInputTokens
**Root cause:** transferInputTokens reads msg.value per order, but msg.value persists across all orders in a batch, so each ETH deposit is credited the full msg.value instead of a split.
**Steps:**
1. Call create/addTokens -> submitInOrders with an Order[] containing multiple ETH deposit orders.
2. Each order's transferInputTokens uses the same msg.value, crediting N orders worth of ETH.
3. Accounted value exceeds actual ETH deposited; withdraw to extract the difference from contract balance.
4. Same applies via sellTokensToWallet/sellTokensToNft -> submitOutOrders, and via Multicall batching.
**How found:** Code reading of transferInputTokens noting msg.value is read per-order inside a loop over a calldata array, and that Multicall preserves msg.value across batched calls.
**Exploitation:** Attacker submits a batch of ETH deposit orders paying one msg.value, receives credited balance for each order, then withdraws to drain the factory's ETH holdings.
**Escalation:** Multicall inheritance allows the same msg.value reuse across separate calls, widening the attack surface beyond a single orders array.
**Insight:** When a function loops over an array of orders and reads msg.value inside, check whether ETH is credited per-iteration; also check inherited Multicall, which reuses msg.value across delegatecalls.