SIZE contest - 0x52's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/706a77e585d0852eae6ba0dca73dc73eb37f8fb6/src/SizeSealed.sol#L122-L170

Vulnerability details

Summary

SizeSealed supports any arbitrary token as both the base and quote token. During auction creation they specifically disallow fee-on-transfer tokens for the base token. For bids they don't disallow fee-on-transfer for the quote token. Auctions run with these tokens will develop token accounting issues when withdrawing and refunding.

Impact

Using a fee-on-transfer token for the quote token will break auction withdrawing and refunding

Proof of Concept

    EncryptedBid memory ebid;
    ebid.sender = msg.sender;
    ebid.quoteAmount = quoteAmount;
    ebid.commitment = commitment;
    ebid.pubKey = pubKey;
    ebid.encryptedMessage = encryptedMessage;

    uint256 bidIndex = a.bids.length;
    // Max of 1000 bids on an auction to prevent DOS
    if (bidIndex >= 1000) {
        revert InvalidState();
    }

    a.bids.push(ebid);

    SafeTransferLib.safeTransferFrom(ERC20(a.params.quoteToken), msg.sender, address(this), quoteAmount);

SizeSealed#bid doesn't check the amount of quote token received from the quote token transfer. Should the quote token be fee-on-transfer, ebid.quoteAmount and the actual amount received will be different. When withdrawing or refunding it will attempt to send more of the token than it has.

Tools Used

Manual Review

Recommended Mitigation Steps

Check the balance before and after the transfer and revert if fee-on-transfer is detected.