# Fund loss or griefing in all order matching functions [matchOneToOneOrders(), matchOneToManyOrders(), matchOrders(), takeMultipleOneOrders(), takeOrders()] because condition (seller != buyer ) is not checked in any of them

Order matching functions lack seller!=buyer check, letting a user's own buy and sell orders match, causing under-fill and fund loss.

- Payout: Contest reward
- Severity: medium
- Program: Infinity NFT Marketplace
- Credited: unforgiven
- Disclosed: 2022-08-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/130
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium technique:source-review vuln:business-logic

**Target:** order matching functions in exchange contract
**Root cause:** Order matching functions do not verify that the buyer and seller are distinct addresses, allowing a user's own orders to be matched against each other.
**Steps:**
1. user1 signs buy order for NFT IDs[1,2] at 10 ETH
2. user1 signs sell orders for ID[1] at 2.5 ETH and ID[2] at 8.5 ETH
3. attacker signs sell order for ID[1] at 7.5 ETH
4. off-chain engine calls `matchOneToManyOrders()` with many orders = [attacker sell ID[1], user1 sell ID[1]] and one order = user1 buy IDs[1,2]
5. contract executes transfers: 7.5 ETH from user1 to attacker, 2.5 ETH from user1 to user1, NFT ID[1] from attacker to user1, NFT ID[1] from user1 to user1
6. user1 receives only NFT ID[1] instead of both, losing funds
**How found:** Code review of order matching functions revealed absence of a check ensuring seller != buyer, and ERC20/ERC721 allow self-transfers.
**Exploitation:** Attacker (or malicious matching engine) submits a set of orders where the buyer's own sell order is included, causing the buyer to pay for an NFT they already own or to receive fewer NFTs than intended, resulting in fund loss or griefing.
**Insight:** When auditing order matching engines, check for missing constraints on order participant relationships (e.g., seller != buyer) that could allow self-matching or circular trades.