# Overpayment of native ETH is not refunded to buyer

InfinityExchange accepts native ETH payments but never refunds overpayment on Dutch/reverse-Dutch auctions, locking surplus ETH in the contract permanently.

- Payout: Audit contest
- Severity: high
- Program: Infinity NFT Marketplace
- Found by: horsefacts
- Disclosed: 2022-08-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/244
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-08
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** InfinityExchange.sol takeOrders/takeMultipleOneOrders native ETH payment path
**Root cause:** takeOrders and takeMultipleOneOrders only require msg.value >= totalPrice and never compute or refund the surplus; combined with a broken rescueETH, overpayment is permanently stuck.
**Steps:**
1. Alice creates reverse Dutch auction sell order: start 500, end 2000, start time 1, end time 5
2. Bob sends tx at time 2 with msg.value = 2000 wei (calculated price 875)
3. Tx included at time 3, calculated price 1250; require(msg.value >= totalPrice) passes
4. Surplus 750 wei accrues in contract balance, no refund issued
5. rescueETH bug prevents owner withdrawal, so surplus is locked forever
**How found:** Code review of ETH payment handling in takeOrders/takeMultipleOneOrders; noticed only a >= check with no refund logic, and reasoned that timestamp-dependent Dutch auction pricing incentivizes overpayment.
**Exploitation:** Buyer overpays to guarantee inclusion during timestamp-dependent auction pricing; surplus is silently absorbed by the contract and unrecoverable.
**Insight:** On any orderbook/auction contract, check whether msg.value is compared with >= and whether the delta is refunded; timestamp-priced auctions make overpayment the norm, not an edge case.