# Missing Complication check in takeMultipleOneOrders

takeMultipleOneOrders skips the Complication rule check, letting anyone fill private-sale orders restricted to a specific taker.

- Payout: Audit contest
- Severity: high
- Program: Infinity NFT Marketplace
- Found by: shenwilly
- Disclosed: 2022-08-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/125
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-05
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** NFT marketplace exchange contract, takeMultipleOneOrders function
**Root cause:** takeMultipleOneOrders assumes all makerOrders are simple orderbook orders and never validates the order's Complication execution rules, unlike single-order take paths.
**Steps:**
1. Alice signs a makerOrder using PrivateSaleComplication restricting taker to Bob.
2. Attacker calls `takeMultipleOneOrders([aliceOrder])` with matching currency and side.
3. Contract hashes order, checks isOrderValid and currency/side but not Complication rules.
4. Order executes for attacker at execPrice, bypassing the private-sale restriction.
**How found:** Code review of takeMultipleOneOrders versus the single-order take path, noticing the Complication execution check present elsewhere is absent in the batch loop.
**Exploitation:** Attacker submits a takeMultipleOneOrders call referencing a victim's restricted makerOrder; since no Complication check runs, the order fills for the attacker instead of the intended taker.
**Insight:** When a protocol has multiple entry points that fill the same order type, diff each path against the canonical one for missing per-order validation hooks like Complication checks.