# canExecTakeOrder mismatches makerOrder and takerItems when duplicated items present

Order validation compared aggregated item counts and membership, so a taker could duplicate a valuable ERC1155 item to fill a multi-collection sell order and pay once.

- Payout: Audit contest
- Severity: high
- Program: Infinity NFT Marketplace
- Found by: PwnedNoMore
- Disclosed: 2022-08-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/12
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** InfinityExchange takeOrders / InfinityOrderBookComplication order validation
**Root cause:** canExecTakeOrder (and canExecMatchOneToMany) only checks the aggregate number of items and that each taker item is contained in the maker order, without ensuring a one-to-one match, so duplicated taker items satisfy the check.
**Steps:**
1. Victim signs a sell order bundling mock1155Contract1 tokenId 0 x1 and mock1155Contract2 tokenId 0 x1.
2. Attacker builds takerItems with mock1155Contract1 tokenId 0 x1 twice instead of the second collection.
3. Attacker approves the sale price in ERC20 and calls `infinityExchange.takeOrders([sellOrder], [nfts_])`.
4. Aggregate count matches and each item is in-scope, so validation passes; attacker receives 2x mock1155Contract1 for the price of the bundle.
**How found:** Code review of the order-matching complication: noticed validation used aggregated counts plus per-item membership rather than exact multiset equality, and hypothesized duplicated items would pass.
**Exploitation:** Attacker pays the signed bundle price but supplies duplicated items from the more valuable collection, receiving n copies of the expensive ERC1155 token while the victim expected to sell one of each collection. Requires the victim to have granted approvals (unlimited or via another order).
**Insight:** When auditing order-matching or bundle validation, check whether the check is set-membership plus count versus true multiset equality; duplicated entries are the classic way to satisfy both while violating the maker's intent.