# Bug in MatchOneToManyOrders may cause tokens theft

MatchOneToManyOrders accepts sell orders containing zero NFTs but still pays the seller, letting a malicious order drain buyer funds.

- Payout: Contest reward
- Severity: medium
- Program: Infinity NFT Marketplace
- Credited: PwnedNoMore
- Disclosed: 2022-08-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/65
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** InfinityExchange.matchOneToManyOrders / matchOrders order-matching
**Root cause:** Order matching does not verify that a sell order actually transfers at least one NFT (numNfts > 0, ERC1155 amount >= 1), so an order with an empty NFT array is still settled and paid.
**Steps:**
1. Craft sellOrder3 with an empty NFT token list but a nonzero price.
2. Submit MatchOneToManyOrders(buyOrder, [sellOrder0, sellOrder1, sellOrder2, sellOrder3]) via the match executor.
3. Matching succeeds; sellOrder3 receives payment without transferring any NFT.
4. Repeat or brute-force price gaps with many off-chain empty orders until one is matched.
**How found:** Observed that the matching loop iterates sell orders and pays each without asserting the NFT transfer array is non-empty; hypothesized an empty order would still settle.
**Exploitation:** Attacker (or a dishonest MATCH_EXECUTOR) appends an empty sell order to a legitimate match set; the settlement loop pays the order's price despite zero NFT transfers, extracting value from the buyer.
**Insight:** In order-matching engines, check that each leg's asset-transfer array is non-empty and amounts >= 1; zero-asset legs still get paid by the settlement loop.