# Malicious tokens can be used to grief buyers and cause loss of their WETH balance

InfinityExchange charges buyers a gas-based fee dynamically; a malicious seller token can burn gas in safeTransferFrom to drain the buyer's approved WETH.

- Payout: Audit contest
- Severity: medium
- Program: Infinity NFT Marketplace
- Found by: 0xalpharush
- Disclosed: 2022-08-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/74
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AM-09
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** InfinityExchange.matchOneToOneOrders / _execMatchOneToOneOrders gas-based fee
**Root cause:** The matcher fee charged to the buyer is computed dynamically from gas consumed during the trace, and the seller's token transfer (safeTransferFrom) can arbitrarily inflate that gas, so the fee is attacker-controlled.
**Steps:**
1. Buyer grants infinite WETH approval to InfinityExchange.
2. Buyer purchases attacker's malicious ERC721 token.
3. Match executor calls `matchOneToOneOrders`, which invokes `_execMatchOneToOneOrders`.
4. During `_transferNFTs`, the malicious token's `safeTransferFrom` wastes large amounts of gas.
5. The dynamically computed gas-based fee pulls an arbitrary (potentially all) WETH from `buy.signer`.
**How found:** Code reading of the fee calculation in matchOneToOneOrders: noticed the amount charged is derived from gas consumed during the trace, and that the seller-controlled token transfer participates in that trace, making the fee attacker-influenced.
**Exploitation:** Attacker lists a malicious ERC721 whose safeTransferFrom burns maximal gas; a buyer with large/infinite WETH approval purchases it, and the match executor's gas-based fee calculation transfers the inflated amount of the buyer's WETH to the protocol.
**Insight:** When a contract computes fees from measured gas usage, any external call inside the measured region (especially token transfer hooks like safeTransferFrom) is attacker-controlled input to the fee; check whether the payer has capped the amount.