# Sellers may lose NFTs when orders are matched with matchOrders()

areNumItemsValid compares buy vs sell constraints instead of constructed item count, letting matchOrders sell more NFTs than the seller authorized.

- Payout: Audit contest
- Severity: high
- Program: Infinity NFT Marketplace
- Found by: KIntern
- Disclosed: 2022-08-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/164
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-10
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** InfinityOrderBookComplication.matchOrders / areNumItemsValid
**Root cause:** areNumItemsValid checks buy.constraints[0] <= sell.constraints[0] instead of numConstructedItems <= sell.constraints[0], so the seller's max-sell constraint is never enforced against the actual constructed item count.
**Steps:**
1. Alice creates sell order: max 2 NFTs from BAYC ids [1,2,3]
2. Bob creates buy order: min 2 NFTs from ids [1,2,3]
3. Match executor calls `matchOrders()` with `constructs = [1,2,3]`
4. areNumItemsValid passes because buy.constraints[0] (2) <= sell.constraints[0] (2)
5. All 3 NFTs [1,2,3] transfer from Alice to Bob, exceeding her max of 2
**How found:** Code review of the constraint validation in areNumItemsValid; noticed the comparison used buy.constraints[0] rather than the actual numConstructedItems against sell.constraints[0].
**Exploitation:** A match executor (or colluding buyer) supplies a constructs list larger than the seller's stated maximum; the faulty constraint check passes and all listed NFTs are transferred, forcing the seller to sell more than authorized.
**Insight:** When a matching engine validates user-specified min/max constraints, verify the check compares the actual constructed quantity against each party's bound, not one party's bound against the other's — cross-constraint comparisons silently skip the real count.