PolymarketBug Token Donation Attack (_updateTakingWithSurplus) taking = _updateTakingWithSurplus(taking, takerAssetId); function _updateTakingWithSurplus(uint256 minimumAmount, uint256 tokenId) internal returns (uint256) { uint256 actualAmount = _getBalance(tokenId); // ENTIRE CONTRACT BALANCE if (actualAmount < minimumAmount) revert TooLittleTokensReceived(); return actualAmount; } Problem After filling maker orders the calculated taking is replaced with the contract entire actual token balance. An attacker watching the mempool can front run a match Orders transaction by sending Usdc directly to the contract address. Those extra tokens get captured as the taker proceeds effectively stealing the donated funds Impact Direct loss of funds for anyone who accidentally or intentionally sends tokens to the contract.
Bug Token Donation Attack (_updateTakingWithSurplus) taking = _updateTakingWithSurplus(taking, takerAssetId); function _updateTakingWithSurplus(uint256 minimumAmount, uint256 tokenId) internal returns (uint256) { uint256 actualAmount = _getBalance(tokenId); // ENTIRE CONTRACT BALANCE if (actualAmount < minimumAmount) revert TooLittleTokensReceived(); return actualAmount; } Problem After filling maker orders the calculated taking is replaced with the contract entire actual token balance. An attacker watching the mempool can front run a match Orders transaction by sending Usdc directly to the contract address. Those extra tokens get captured as the taker proceeds effectively stealing the donated funds Impact Direct loss of funds for anyone who accidentally or intentionally sends tokens to the contract.