SIZE contest - 0xc0ffEE's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L96-L105

Vulnerability details

Impact

When creating a new auction, auctionParams.totalBaseAmount amount of token is transferred from seller to SizeSealed and there is a contract balance check balanceAfterTransfer - balanceBeforeTransfer != auctionParams.totalBaseAmount. This check could fail when interacting with inflationary, deflationary or rebasing token. For example with deflationary token, the balance of recipient is not increased by the amount of the transfer (it means balanceAfterTransfer - balanceBeforeTransfer < auctionParams.totalBaseAmount). Because there is no documentation about token behavior restrictions, this issue should be considered

Proof of Concept

https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L96-L105

Tools Used

Manual review

Recommended Mitigation Steps

Should track the real increased balance increment instead of verifying it so that when the auction ends, withdrawals still successfully

uint256 balanceBeforeTransfer = ERC20(auctionParams.baseToken).balanceOf(address(this));
SafeTransferLib.safeTransferFrom(ERC20(auctionParams.baseToken), msg.sender, address(this), auctionParams.totalBaseAmount);
uint256 balanceAfterTransfer = ERC20(auctionParams.baseToken).balanceOf(address(this));
a.params.totalBaseAmount = balanceAfterTransfer - balanceBeforeTransfer;

1. function bid should check for whether the auction is valid or not by checking a.data.seller != address(0). Because the auction could be cancelled by the seller and then the auction accepts bid forever but nobody could finalize it. This could cause the bidder to waste gas fee when unintentionally bid for cancelled auction (the bidder has to cancel bid to retrieve fund)
2. function cancelBid should remove bid at bidIndex from a.bids so that the number of 1000 bids in function bid does not involve cancelled bid -> the number of effective bids is increased