Ensure zero msg.value if transferring from user and baseAsset is not WETH.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L338
https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L360
https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L436

Vulnerability details

Impact

Ensure zero msg.value if transferring from user and baseAsset is not WETH.
A user that mistakenly calls either fillOrder() or exercise() with native ETH when baseAsset is not WETH, his native ETH will be locked in the contract.

Proof of Concept

There is a reference of the same issue.

Tools Used

Solidity Visual Developer of VSCode

Recommended Mitigation Steps

We should ensure msg.value == 0 for above cases.

} else {
    require(msg.value == 0, "ETH sent");
    ERC20(order.baseAsset).safeTransferFrom(msg.sender, order.maker, order.premium);
}

[rotcivegaf]

Duplicate of #226

[outdoteth]

Duplicate: Native ETH can be lost if it’s not utilised in exercise and fillOrder: #226