NextGen - 0xMosh's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L57

Vulnerability details

Impact

Detailed description of the impact of this finding.

Proof of Concept

Participating in auction requires a higher bid to successfully call participateToAuction function :

 function participateToAuction(uint256 _tokenid) public payable {
        require(msg.value > returnHighestBid(_tokenid) && block.timestamp <= minter.getAuctionEndTime(_tokenid) && minter.getAuctionStatus(_tokenid) == true);
        auctionInfoStru memory newBid = auctionInfoStru(msg.sender, msg.value, true);
        auctionInfoData[_tokenid].push(newBid);
    }

And anyone can cancels his bid before the auction ends :

  function cancelBid(uint256 _tokenid, uint256 index) public {
        require(block.timestamp <= minter.getAuctionEndTime(_tokenid), "Auction ended");
        require(auctionInfoData[_tokenid][index].bidder == msg.sender && auctionInfoData[_tokenid][index].status == true);
        auctionInfoData[_tokenid][index].status = false;
        (bool success, ) = payable(auctionInfoData[_tokenid][index].bidder).call{value: auctionInfoData[_tokenid][index].bid}("");
        emit CancelBid(msg.sender, _tokenid, index, success, auctionInfoData[_tokenid][index].bid);
    }

This arises an exploit scenario where an attacker can win the auction with bare minimum price :

exploit :

1. Bob (attacker) bids the first bid of 1 wei . participateToAuction function works perfectly as there was no previous bid .
2. bob bids a large amount (lets say 10000 eth ) and become the highest bidder .
3. Nobody can place a bid now as participateToAuction function requires the bid to be larger than 10000 eth .
4. just second before auction ends , bob cancels his 2nd bid withdraw the funds .
5. Auciton ends and Bob wins the auction with just 1 wei !!

Tools Used

Review

Recommended Mitigation Steps

Bids should be refunded after auction ends . The implementation should be in this way .

Assessed type

DoS