`canExecTakeOrder` mismatches `makerOrder` and `takerItems` when duplicated items present about 2022-06-infinity-findings

[nneverlander]

Fixed in infinitydotxyz/exchange-contracts-v2@bbbd362

[nneverlander]

#88

[nneverlander]

#142

[nneverlander]

#178

[nneverlander]

#307

[nneverlander]

#332

[HardlyDifficult]

There were several reports of this issue. Accepting this one as the primary since it's the best description that also included a test demonstrating the problem. This helps a lot to understand and confirm the issue.

This is a High risk issue. The PoC demonstrates how a maker specifying a bundle of NFTs could incorrectly have one ERC1155 item in that bundle processed several times by the taker - the bundle is not fully accepted as expected, the item processed multiple times is essentially overfilled, and this may be abused to the taker's advantage when the NFTs are not valued the same.