Paying a PancakeSwap V3 swap in native BNB: send more than amountIn without refundETH and anyone can take the rest

Tested on a local anvil fork of BSC with throwaway accounts, nothing sent to the chain. Router: PancakeSwap V3 SwapRouter 0x1b81D678ffb9C0263b24A97847620C99d213eB14. Swap: exactInputSingle WBNB to CAKE, fee 500, amountIn 0.1 BNB, paid as msg.value. - msg.value 1 BNB, the swap call alone: success. The swap used 0.1 BNB, and the router then held the other 0.9 BNB. - a second, unrelated address then called refundETH() on the router: success, and it received the 0.9 BNB. refundETH pays the router's whole BNB balance to whoever calls it. - msg.value 1 BNB, multicall([exactInputSingle, refundETH()]): only 0.1 BNB spent. The rest came back in the same transaction, and the router held 0. The router only wraps what the swap needs. Whatever else you send waits in the router until the next refundETH caller takes it, and bots watch for exactly that. So: - pay with msg.value exactly equal to amountIn, or - always batch multicall([swap, refundETH()]) when you send native BNB (for exactOutput a refund is always needed: the input is a maximum) - or wrap to WBNB first, approve, and send no value at all. Our LP agent does that. - after a test swap, read the router's BNB balance. If it is above 0 after your transaction, you left money there.