# Malicious governance can use updateWethTranferGas to steal WETH from buyers

Uncapped WETH_TRANSFER_GAS_UNITS lets malicious governance inflate gas-cost accounting to drain approved WETH from buyers filling orders.

- Payout: Contest reward
- Severity: medium
- Program: Infinity NFT Marketplace
- Credited: shenwilly
- Disclosed: 2022-08-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/127
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** InfinityExchange.sol order-matching contract
**Root cause:** WETH_TRANSFER_GAS_UNITS is owner-settable with no upper bound and feeds directly into the gasCost charged to order takers, so governance can set it arbitrarily high.
**Steps:**
1. Alice approves InfinityExchange infinite WETH/USDC allowance and signs a buy order for a FakePunk at 100 USDC.
2. Governance calls `updateWethTranferGas` with a huge value so the gasCost computation equals ~100 WETH.
3. Governance acquires a FakePunk on the open market and fills Alice's buy order.
4. Alice receives the NFT but is charged 100 WETH as gas cost, which governance captures.
**How found:** Code review of the gasCost calculation and the owner-only updateWethTranferGas setter, noticing the parameter is uncapped and directly determines how much WETH is pulled from the order taker.
**Exploitation:** Governance frontruns or self-fills active buy orders after inflating WETH_TRANSFER_GAS_UNITS; the inflated gasCost is deducted in WETH from the buyer's approved balance and routed to the caller, making the attack profitable whenever stolen WETH exceeds NFT acquisition cost.
**Insight:** When a contract reimburses or charges gas based on an admin-set constant, check whether that constant is bounded and whether it feeds a value transfer from user-approved balances; uncapped gas parameters become a drain primitive for compromised or malicious governance.